Being a web doesnt mean the access always via browser http...think of some have curl,someone who can make an app that acts as a browser itself.......lots of apps arent that secure from what i know,sometimes it depends on that cost-benefit as seen by the attacker ....M-Pesa etc they are real happy because they use their  own network,and clients cant  misbehave and breaking security would require to attack the network ....