It depends on what you mean by security... As soon an you use a dedicated mail application, you keep a copy of the messages on the local client. Said differently, you add an element on the chain and the global security of a chain is the one of its weakest element.
That being said, the security server side is just a username+password. So having a local copy does not really add weakeness, except for the physical security question. If you have a desktop in a correctly protected building, the question of a physical theft of mail is likely to be less important than the question of a physical intrusion. If you use a phone or a desktop that you carry with you, the risk of a physical theft is much higher, and you should considere using full disk encryption.
For the more general question, the response could vary. But anyway a multi tier application should have at least a presentation layer (web or app), a business layer and persistence layer. The business and persistence layer should be server side, and the kernel of the authorization rules should be implemented server side on the service layer. The authentication should be the same, and the protocol between client and server should use same level of protection (TLS or SSL) with server certificate and client authentication, so as for the mail, the main question will be the security of local data.
An do not forget, the weakest element on a security chain is often the user itself: the strongest password will not be able to protect your account if is is written on a postit at the bottom of the screen. The password container of most browser can be a major risk if it is not itself password protected, and the same rule applies to rich client applications.