The “web-based” solution, which runs on a remote server, is generally able to be reached by the general public through a web page. It constitutes a web page with a chatbot embedded in it, and a text form is the sole interface between the user (you) and the chatbot. Any “upgrades” or improvements to the interface are solely the option and responsibility of the botmaster.
Yes. Messenger bots are approved by Facebook before being made available inside the Messenger app so you can rest assured that they aren’t trying to steal your identity (or anything else). What’s more is a bot is tied to a Facebook page and a Facebook app making it all the more inconvenient to use for fraudulent activity. That said, don’t exchange private and/or personal information with a bot. Finally, because Messenger doesn’t support credit cards and purchasing just yet, anything you buy will likely be done via a browser with a bot aiding you so far as to place an order. If you want, you can always block a bot.