No major advantage over SMS. It just sounds great, but that's about it. If someone has your phone you are compromised be it via SMS or their app. Disadvantage is numerous, (1) if you lose your phone, you are in for a world of hurt trying to reauthenticate, (2) all users without smart phone are out i.e, users in 3rd world countries where data is readily not available but SMS is. I personally think they should have done both.
SMS is a huge security hole; it's not secure at all. Literally child's play to circumvent, intercept and spoof. (Also, unfortunately, they still have an SMS option for when you lose your device, which doesn't make much sense, but whatever)
To add to this, SMS may seem like an unrealistic security hole but you have to consider that there are some very high profile twitter accounts. Intercepting SMS messages may not seem like something your pain in the ass neighbor is likely to do to you, but there are far more interesting targets with twitter accounts than you.
