Zimperium's security research team publishes vulnerability analyses and malware write-ups, mostly about Android and mobile devices.
HN commenters link it as a source for Android security reports, such as malware, AirDroid flaws, and Qualcomm kernel vulnerabilities. No opinions on quality are given.
That's that's an argument for security, less so for privacy, in the sense that the surface area may yield points for exploits.
But the payment stack is also very complicated. It touches everything from the secure enclave up to the Merchant over the network.
And if accessing the USB stack is bad, then doing it from a native app is too bad. The Web execution environment is more isolated and abstracted than the native app SDK, see https://blog.zimperium.com/dr-jekyll-and-mr-hide-how-covert-malware-made-it-into-apples-app-store/ for example of live malware getting past the app review process and accessing geo location and other things to fingerprint.
My computer has never, in at least the last 15 years, been infested by usage of Web APIs. Since the time of Firefox and Chrome taking over from IE4-IE6, I have been free of exploits. It's fair to say that the web is used by billions of people, and for the most part, large scale carnage using browser vectors has been limited.
I don't think your conclusions are based on actual security researcher threat modeling, but more about an implicit bias against Web apps and towards native.
Multiple Kernel Vulnerabilities Affecting All Qualcomm Devices (2020)
https://blog.zimperium.com/multiple-kernel-vulnerabilities-affecting-all-qualcomm-devices/
The Road to Qualcomm TrustZone Apps Fuzzing (2019)
https://research.checkpoint.com/2019/the-road-to-qualcomm-trustzone-apps-fuzzing/
QualPwn - Exploiting Qualcomm WLAN and Modem Over The Air (2019)
https://blade.tencent.com/en/advisories/qualpwn/
QuadRooter: New Android Vulnerabilities in Over 900 Million Devices (2016)
https://blog.checkpoint.com/2016/08/07/quadrooter/
Security reports for Android
https://blog.zimperium.com/new-advanced-android-malware-posing-as-system-update/
-> "Upon installation (from a third party store, not Google Play Store), the device gets registered with the Firebase Command and Control (C&C) with details such as the presence or absence of WhatsApp, battery percentage, storage stats, the token received from the Firebase messaging service, and the type of internet connection. "
It isn't hard to find similar reports, there are enough of them.
Any random apps promising "vouchers" or "coupon codes" installed on your phone? Do you have an Android device?
https://blog.zimperium.com/flytrap-android-malware-compromises-thousands-of-facebook-accounts/
EDIT: I hope you get your account back. Maybe if you're able to pinpoint that some malware took over your account, facebook support would be more sympathetic? I sure hope they have some process in place for accounts that fall prey to these malicious apps.
There are a good number of stories now out about this:
http://www.techmeme.com/150727/p8#a150727p8
It seems one of the original reports is here:
http://blog.zimperium.com/experts-found-a-unicorn-in-the-heart-of-android/
I'd also note that it seems this is research that will be presented next week at Black Hat and then again at DefCon.
A more in-depth article about this can be read via the following link: https://blog.zimperium.com/analysis-of-multiple-vulnerabilities-in-different-open-source-bts-products/