Core Update: Which Is Safer, Patching or Drush?
At the end of the day, by whatever method you use, what you have accomplished is changing the code on your Drupal site.  In theory, both methods you mention should produce the same result.

What I recommend is that you first upgrade and test on a dev machine, and then, once you have tested everything and are convinced that the set of code files that you have is correct, move those exact files to production.  There are a number of ways you can do that.  Some people like to commit all of the files to git, and then use git push / git pull to deploy.  Rsync is another common way to move the code files over.  Then, you just need to run updatedb (unless you determined in testing that there are no updates required), and bring your site back online.

So, in summary, "safer" depends on your deployment plan, not your upgrade technique.