Both have weaknesses, but with an OS, you have certain bottlenecks - like your app memory is paged and has its own memory space, data structures are often duplicated in user and kernel memory, syscalls have cost, which is why io_uring is a thing in Linux.

This is all unnecessary overhead and complexity, as the OS doesn't really mediate hardware access in this case.

But you're right on some points, it's not really more secure, but there's a hell of a lot less complexity where things can go wrong.

It's conceptually equivalent but the details differ. The program has access to more abilities and in terms of common conventions the security boundary is much more robust. If nothing else I'd argue it's a superior abstraction with which to make the delineation.