They key difference is with mTLS approach you'd have to steal the private key of the client certificate if you want to impersonate the client. In most secure deployments of mTLS and short lived certs, private key never escapes the TPM, Secure enclave or Yubikey, so it's extremely hard to mount an attack and impersonate a service.
With JWT (assuming it's not bound) you can steal JWT token and re-use it until it expires.
With JWT (assuming it's not bound) you can steal JWT token and re-use it until it expires.