The whole security angle is an after-the-fact rationalization and the vast majority of users (not developers,
users) never cared much about it - as anyone in the IT department of pretty much every company can tell you (again, users, not developers, not sysops, not admins, but regular end users).
The real reason we see so many web apps is that the decision on what technology to use for an application is largely something developers decide (with "developers" i do not only mean individuals but also companies and organizations that develop applications) and the web gives developers pretty much complete control over what is going on in their application, what the users can do and how, allows them to force everyone use the same version, allows realtime monitoring of how the users use their applications and provides the vendor locking tightest than the most obfuscated native application could have (since all the data is stored in the servers).
Security is just a very convenient excuse since a lot of people shut down their critical thinking whenever it comes up (my guess for why that happens is that since a lot of people have been shamed by supposedly security experts and even more people have mimicked that shaming, we ended up with everyone just shutting up whenever security is brought up to avoid looking like That Clueless One that would be shamed next - but that is just a guess).
But the real reason is the heavy control that web apps give to the developers and the vast majority of users do not really understand how biased against them that setup is.