There isn't really a security difference if both desktop app and browser app are properly built. Yet, I would definitely lean towards the browser app because you get several features "for free" (e.g. PKI for HTTPS).
All security measures that are present in modern browsers can be built into a desktop app alright. The problem is that that would likely require more development effort and allow for more places where mistakes can happen.
Let's have some fun with counterarguments now:
Desktop is safer since it stops random people from manipulating our data if they don't have the program
LOL! < sarcasm >Yeah, reverse engineering does not exist, and obscurity can prevent eavesdropping < / sarcasm >.
With the amount of computing power we have today security through obscurity is getting less and less possible. A couple of megabytes of traffic dumped into a statistical model can construct a specification of how data is sent. And, unless you will never repeat the same commands to the admin interface, you cannot escape from a statistical model by using obscurity only.
Your only option is encryption. Which means you will need to implement full TLS. And by full I mean TLS (you could use openssl for this part) and HSTS, and a revocation path for compromised certs, and a CSP would be good as well. And all that carefully enough to not make mistakes. Cryptography does not allow space for coding mistakes.
Rival company is employing this method. Currently they are no.1 in the market
MasterCard still uses mainframes to process (some of their) Chipcard data. And still send different clearing files in distinct EBCDIC flavours. Shall we all use mainframes for payments?
You can still make mistakes in the web app and make it worse than a desktop app. But there is a lot of documentation about securing web apps.
There are also good frameworks to build desktop apps that come bundled with TLS communication. Using one of those (Python paramiko and Microsoft WIF come to my mind) is an option but see the next section:
The Achilles heel (in terms of security) of desktop apps is their dependency tree. A desktop app will require dozens of libraries, which may have security bugs. You will need to keep an eye on the CVEs for all libraries. And, if one of the libraries turns out to not be very popular, there will not be many bughunters looking at it.
And finally come the desktop app updates. You found that your desktop app is vulnerable to something and patched it. Good! But now you need to distribute the new version to everyone using it, including that guy who is working from home for the past two months. OK, you may send him an email with the new installer. But wait, can't the email be tampered with? Or even in a more mundane point, can you be sure that he will update his app?
A web app is much easier to update.