I would tend to trust Apple more as they define attack vectors and mitigations in their platform security guide. Also they have a holistic approach to this from hardware through to software, not just an app tacked crudely onto whatever APIs were lying around.

I would NOT trust Microsoft though. I've had enough problems with Authenticator and so have other users in our org that I refuse to put data near it. Not concerned so much about other people getting access to it but me losing my data.