I had the same question and I wrote a small post about this in my blog
The reason is summarized here (I found this on a forum):
*_path are for views because ahrefs are implicitly linked to the current URL. So it’d be a waste of bytes to repeat it over and over. In the controller, though, *_url is needed for redirect_to because the HTTP specification mandates that the Location: header in 3xx redirects is a complete URL.
Here is another explanation which says it depends on whether we need to use an absolute URI when linking to an SSL site from a non-SSL site, and vice versa.
What I have read so far, doesn’t suggest that any of them is more secure than the other. It really comes down to what is the “proper” usage.