Xapo android wallet - security depends on full Android stack + trust of manufacturer (all normal phones uses closedsource drivers).

Xapo vault - you don't own private keys = you don't own your bitcoins.

Trezor - you're sole owner of your bitcoins.