JS engines are supposed to be sandboxed, and have limited APIs to draw from. Unless you use a jail, a local application can do just about anything.
The difference is expectation. I expect websites to run things I don't control. I expect a local application to behave in a certain way.