IT's not an either/or situation. Keep in mind that the logic isn't necessarily the raw commands to the devices. In a system like CQC, the logic behind a button in a user interface is there in the button. But that's not the actual commands. Those are commands to the server to carry out the activities desired, and only after providing proper credentials to the server to prove you have the right to do so. And it also requires the same sort of credentials in order to modify any configuration of the system.
Putting both of those things in a phone is probably not good from a security standpoint. Once someone has the phone, your system is open. In a scheme like I describe above, they can't get physically to your server to crack the security. In the phone scenario, they do have the device and if they physically have the device, security doesn't mean much. If being able to run the automation app and send any commands you want only depends on being able to log into the phone, then any means to crack the phone means direct access to your devices.
But of course some folks coming along now, who are enamored of the 'internet of things' and how everything is going to automagically become part of the automation system without human intervention and all that, are probably not going to put security first. And some of those systems are going to be neon signs to hackers. And many will almost certainly tend to take a 'the phone is the system' approach as well, since that's how a lot of people think these days.
