Web applications have lots of essential parts on the server-side even if they do client-side rendering. And each paying user is logged in when using it, so the company can accept/deny requests depending on the user.

Proprietary desktop applications are usually downloaded after a payment, and then the full software is available locally. By hacking the security parts of it one can then have a totally free version and distribute it. That's why it is easier to pirate.