the "unofficial" one is equivalent to the official one, the difference being that one runs on your phone, the other runs on your mobile device.
Mobile devices can be rooted and your mobile authenticator compromised.
Your PC can be rooted and WinAuth compromised.
But here's the deal. If your PC is rooted, then your mobile authenticator isn't helping you anyway, so WinAuth is no less secure or safe than the official authenticator.
Sure, I already mentioned that the PC authenticator is insecure. However, Blizzard actually say that they cant be held liable for any problems that occur with the "inofficial" authenticator.
And even what you said, all that just goes down to: Blizzard should include the physical authenticator with every purchase of the game for free, since, apparently, they cant get their account security to work without it.