“Both open source and both use AES256 on client side. That's the verifiable part. For SN's apps, my point above to Mr/Ms Architect applies. I'm not sure whether if someone can easily verify the shipped and compiled app code, so more or less the same story as servers being open source. Doesn't change much.”
You’re still thinking (Client Side App) & (Client Side WebApp) brings the same security implications. But they don’t.
You can not verify that the code of a webapp isn’t being changed per each session reload.
With a client side app, you can download the source code of an app, self audit the source code in a couple weeks, and then self compile. This means there is never any required trust besides your own auditing abilities and the underlying software and hardware you audit on.
All of which for a privacy concerned user, is secured under a high security threat model.
“As an OCD-legal folk”
“Unless I'm missing something here”
This is the problem. You are looking at this purely through the lens of a lawyer. Not from the lens of a security professional.
If you know someone is coming after you with a gun. Your first thought is not gonna be, “I hope I’m in a good legal jurisdiction, so the laws protect me”.
Ultimately laws are only a valid construct in a court room. Outside of that, they hold very little power in actually protecting you from anything.