Java desktop app vs web service

I currently have a desktop app written in Java (Swing) which talks to a C-based backend over SSL. I am trying to understand the pros/con from a security perspective to move to a web service model. There are multiple business and engineering reasons to do it but our business data is very sensitive, so security trumps the other reasons.

I hear about Java security patches every other week it seems but hear similar things with web browser/server exploits. For the web services model we would plan to use node.js running in a docker to isolate it. It would be talking to redis and/or postgresql only.