I have a Gmail account and I am using Samsung email app. Recently I have switched to the Gmail app because I thought using the Gmail app would be safer because that app would automatically filter phishing attacks. I wonder if Google handles security threats on the server side and automatically puts unsafe emails into a different folder such as the spam folder. Is it a safe practice to use the Samsung email app against phishing, does Gmail handle Security on the server side? Do I have to use the Gmail app so that Gmail filters malicious emails?
For an IMAP server (which is how most third party apps see Gmail), the folder structure is on the server - it doesn't matter what client you use, since you should see the same folders, with the same contents. Since the filtering is applied on the server side, it shouldn't therefore matter what app you use.
However, it is always possible for phishing emails to get past automated filters - no system is perfect - so it is important not to rely on email in "safe" folders as being 100% safe. Just because a message got past server side filters, it could still be malicious, or link to a page which attempts to get your credentials. Phishing is one of the types of attack where user awareness is also important to prevent issues.
Spam and phishing protections are handled on the server side, not on the app. It is much easier to put all that processing power and the analysis and correlation on their servers than trying to do all that on a device or a browser.
As Matthew and schroeder have said, spam filtering in Gmail is handled on the server itself and not your email client, so it wouldn't matter what client you use; detected spam will just be in your spam folder instead.
However, the email client will not tell you the reason as to why the email was moved to the spam folder, which means you've got less context. The Gmail website (and I believe the Gmail app) does display a notice on emails marked as spam or suspicious (and for phishing emails the contact image is displayed as a fishing hook). You'll have to check through the email data (like the true sender for example) to determine the reason for it being marked as such, assuming the program you use doesn't warn you of this already.