IMO, the problem with putting your nsecs in apps is that you're putting trust in the app developer not just to not turn evil, but also to not make any mistakes.
Ditto just had an exploit that allowed stealing private keys via a malicious link on Android. That was clearly unintended, and was patched right away, but some keys got leaked anyway.
On top of that, it would be trivial for an app developer to actually steal your keys by simply sending them to another server without you noticing. This could be accomplished by simply pushing out an update to the app, which most people would likely install without much fuss.
Using a remote signer at least reduces the risk of exposure to a single app or device. Sure, those CAN be comprised also (see Coldcard), but the risk is at least smaller than if you spread your keys around over many different apps.
