Definitely Less Secure
The two biggest concerns apply to all software tokens, not just FIDO.
Platform Vulnerabilities
Hardware security keys provide a relatively strong protection of their cryptographic secrets (either a private key or a seed value). This protection is severely reduced when you implement the functionality on a general purpose OS. If the OS is compromised, an attacker could steal the secret. This extends the risk to include firmware bugs, debug modes, OS vulnerabilities, other software, user issue, etc.
With the well-known problems keeping Android phones up to date, it is especially risky on that platform.
Exclusive Control
The second issue is that compromised credentials are apparent with a hardware token. A user probably will never notice when their smartphone is hacked. In all likelihood, the 2FA app will continue to function normally. With a hardware token, a user will definitely notice when their token is lost or stolen.
You can generally assume a user has exclusive control over their 2FA hardware until shortly before it is reported lost. There can be no such assumption for 2FA credentials stored in software.
Bad Security, But Possibly Worth The Trade-off
In the end, a software 2FA implementation is more prone to being compromised and less prone to detecting successful attacks.
However, it will be cheaper and easier to provision if your users already have supported devices.
This is a classic cost-vs-security trade-off, and organizations make decisions like this all the time. Personally, given the low cost of hardware tokens, I would never choose the app, even if it were free.
