To be honest OTA is safer if you are comparing the safetyness of them.
Manually you only download the rom .zip file and flash it in TWRP recovery or you command Updater app to boot to recovery and flash it. By doing this TWRP will skip md5 checking as you do not have this file, thus making you vulnerable to bricked device by flashing corrupted file.
This is why you should also make sure the md5 matches by checking it manually every time you update.
If you download new rom by Updater app, the app will download the rom .zip file and md5 file and during flashing, it will compare the rom file with the md5 file and if it passes, it will flash the update, if it fails the check it will stop flashing and reboot to system and no harm was done.