None is bad due to 2 reasons. First - you can be hacked. Second - you'd have some problems due to additional security things from Blizzard, like blocking your account, when your IP changes, you log in from another computer, etc. All this things don't work, when you use authenticator.
App is pointless, cuz phone can be hacked or Google/Apple can sell your data to 3rd parties. And whole point of authenticator - is that nobody has physical access to it, except you.
You can also use WinAuth, if you don't trust your phone, but it's bad for the same reason. You just can make one big authenticator from some old PC without Internet access.
Mine physical one still works since Cata. Only problem - if I don't use it for a long time, it's button starts to rust. But problem fixes itself with time, when I use it. It can't be repaired, I guess, cuz it requires very precise time sync, that would be lost, when you'd replace battery. You don't need one from Blizzard. They're standard, so you can buy any.