The User Agent (UA) and Web Server (WS) flows have two different security purposes. The main difference is that UA is used for untrusted clients, while WS is used for a server application; the WS uses a Client Secret (CS) as an extra authorization parameter to prevent spoofing servers.
The reason for this is that if a server is compromised, everyone using that server is compromised, and the CS can be changed to prevent those rogue servers from authenticating users. The UA flow naturally assumes the client is untrusted, which is okay, because each individual client has to be compromised in order to have a major security problem. It's a matter of scale.
So, the general rule is this: if the client is the one authenticating, use the UA flow, while if the server is the one authenticating, use the WS flow. While you can use either flow in either situation, using the wrong flow in the wrong situation is a majority security risk.
UA flows should be used for any mobile or desktop app where the source code may be viewed. WS flows should be used for any server/cloud application where the business logic source code cannot be viewed.