Some academics tested 110 popular, free Android and iOS apps in the Journal of Technology Science. They found that "73% of Android apps shared personal information such as email address with third parties, and 47% of iOS apps shared geo-coordinates and other location data with third parties".
It is significantly harder to audit the security of an app than a webpage, because with a webpage all the code is visible to you, the end user.
For a very loose definition of "all the code"
All the client-side code then.
Anyone vaguely skilled can reverse engineer an android app. Modern versions of android (ie Android 6, which I appreciate only 0.0001% of android users actually have) let you control which permissions an app can use.
If "vaguely skilled" is what it takes to audit an Android app, then "borderline incompetent" is all you need to audit a web app. Other commenters are talking about relative ease, not absolute impossibility.
Apps tend to ask for far too many permissions beyond those available to the browser, including your contacts list, SMS history, etc.
(Of course, the government already has all of this stuff)
Ok - so I see the answers, but we're taking about apps shipped by the government. What's the concern? That they'll bug your microphone, or do identity theft?