If you have a <form> element with a submit button: <button type="submit">...</button> – use wire:submit="...".
Other than that, if you just have a regular button outside of a form: <button type="button">...</button> – use wire:click="...".
You can have input elements outside of a form and use a regular button, but the proper (and semantic) way is to wrap that in a <form> tag.
The real difference comes down to how that event is natively handled by the browser. There is no difference in security between the two. You can access any public method on your component via JS without it being "wired" to anything on the page.
In a form with a submit button as shown above, the browser's native action when clicked is to submit the form and refresh the page. Attaching wire:submit="..." to the <form> element tells Livewire to catch that submit event and prevent the browser's default action of submitting and refreshing the page.
If you had an anchor (or link) element like <a href="#">Do something</a>, the browser's default action is to go to that place (in this case it's a URL fragment with no ID so it will just jump to the top of the page). Attaching wire:click with the .prevent modifier (wire:click.prevent="...") tells Livewire to catch that click event and prevent the browser's default action of going to that place (but note that semantically, a <button> is better suited here).