It does not mean that lemmy is less secure, but yes, it means that malicious app developers will have a much easier time stealing login credentials because entering them inside the app is already the norm. However this is definitely a feature that can be added so it does not mean anything bad long term

Even though they are both fediverse they still are quite different and one of the important differences is that lemmy does not support oauth so apps don’t have that option, as for why all mastodon apps use it: it’s because of the security benefits to the user and (as a lemmy app developer) implementing auth is hard lol