Absolutely, the thick client / desktop application is running on individual PC or terminal, and this thick client application that access the database directly could be tempered. And the database connection requires password at several layers, from network connection layers, to VPN and even the database server itself. For an organization with hundreds of users, there are bound to be PC breakdown etc. And if the technicians maintaining these terminals / PC change, the passwords at all terminals / PC have to change, if not, security could be compromised.

This is completely different for web based application, because the program (application) and database are both running inside the server. That means, user connect to the application from a web browser, which has got SSL encryption etc.