How is firmware TPM different from the discreet one?

It is very hard to quantify security and justify trust. Before you read on: think about what you want to protect against whom. Make a risk analysis. I have heard mainly two justifications why physical Firmware TPM is more secure.

1) Separation/Isolation Generally, the better two systems are isolated, the harder it is to spread compromisation. For example, you can hardly attack network #2 from network #1 if they are not physically connected. If they were connected via a firewall, it might be possible, but still hard. The least secure option would be no separation at all.

The same applies to the isolation of the host machine and its TPM. A user-space TPM simulator would hardly be isolated at all and the least secure option. A fTPM is isolated much better, but it's still running on the same chip. A hardware TPM is much more isolated and therefore presumably better protected against software attacks from host malware. Of course there is a whole variety of hardware attacks which is not affected by this isolation. Again, think about your assets and risks.

2) Certification Physical TPMs are usually certified. That alone is not a guarantee for security. However, it ensures that certain requirements are met verifiably. Therefore it is evidence at least some level of security.

In particular, the Common Criteria Evaluation takes hardware security against e.g. timing, glitching and side-channel attacks into account. Currently, there are only physical TPMs which are Common Criteria evaluated (see here under Trusted Computing).