If the desktop app need internet access, then the web app is more secure if a secure browser like Chromium-Edge is in usage.
If the desktop app is a fully AppContainer app from Windows Store then that may be more secure but i guess the difference to Edge isn't much as Edge itself is isolated too.
Normal desktop programs are mostly more vulnerable as they use a lot of code, are mainly unmaintained and aren't build for security. Best example are Java based programs.