Because software could impersonate and trick the user into giving away sensitive information, such as credit card data, or authentication to act on behalf of the user.

Emails and phishing websites are much more widely used than standalone software for tricking users into giving away personal information because 1) compared to building an application in Java or Objective C it's much easier to craft emails and fake websites and 2) everyone is already browsing the web.