You can make mistakes with both. The Google play store regularly hosts fake and malicious apps which are disguised as the real thing which you can accidentally download. Similarly, there are plenty of fake websites designed to trick you in to downloading fake apps, and these websites will also appear on Google search results. You should never trust an app just because it came from a specific source or what you believe was the legitimate website. Even if it did, websites and servers can be hacked and have the real files replaced with malicious ones.

The correct way to ensure your safety is to verify the download against the PGP signatures of the developers or the provided hashes prior to installing. You should download the software in question from the official site on your desktop or laptop, verify the file you have downloaded, and then transfer it to your phone to be installed.