In addition to the PIN, there is the option to add a separate encryption passphrase. This passphrase encrypts the wallet seed, and is needed to access your wallet either with the Trezor or with the recovery phrase. One advantage is you can create multiple wallets hidden behind multiple passphrases (in effect, every passphrase is correct and will lead to a distinct wallet). This way, you can create decoy wallets with different passphrases, and hand these over in the case of extortion, customs agents, etc. It also renders the recovery seed useless without the encryption passphrase, so if another person gains access to your seed, you are safe. Same thing if your physical device is somehow compromised, as was demonstrated in the past...an encryption passphrase would nullify these problems.

This option is also available on Trezor One, but the passphrase had to be entered on your computer keyboard, which is vulnerable to keylogger hacking. The difference with the Model T is you can enter this passphrase directly on the device, making it the most secure hardware wallet yet in my option. Trezor One is still extremely safe, and it would take a multi-point attack to defeat a Trezor One with passphrase enabled (access to seed plus the passphrase, or compromise the device plus access passphrase).

Other than this, it's mostly just convenience in favor of the Model T, although in the future they are planning to add data encryption and other features (there is a micro SD card slot on the Model T).