Given the connectivity of a mobile phone, it seems vastly more
vulnerable than a device with a button and display which would need to
be disassembled to gain access (but even with direct hardware access,
is the key protected?) Given that both add some additional security
and the pool of people who opt not to use it is still large (if not
the majority), this is probably a non-issue in the Battle.NET case,
but generally, how do they compare?
Your question really is: "Is a desktop application that generates a security token as secure as a physical device that does the same"
The answer to this question is: it depends
Recently it was discovered that the RSA Windows application that generates a security token has security flaw because of not only how it works but because it uses a security feature built into Windows to protect the token data. In order to keep this statement short, it was discovered that the token can be copied, which allows future tokens to be generated.
This flaw also exists in some versions of mobile authenticators. For instance It is possible to "duplicate" the Blizzard Mobile Authenticator and write a desktop application if you root/jailbreak your Android/IPhone and copy the serial and secret token. This is because the file that contains this information at least on Android is not protected that well ( shift operation ). In the case of a jailbroken IPhone basic security features in the operating system can be disabled, which normally cannot be disabled, in order to do something similar.
In the end an application on a closed system like a mobile phone is a great deal more secure then a traditional desktop application.
I consider Android, Windows Phone 7.x, and iPhone to be closed systems
Some of the problems with the RSA Windows desktop application likely stims from their earlier compromised based on how the algorithm works