Can you have both TBA and Oauth 2.0 enabled? We have only TBA and planning to enable Oauth 2.0... Are there any drawbacks?

I'm sure you can. I have some oauth 2.0 integrations and some that use TBA and they coexist fine.

Thanks @creece

Also Oauth has to get refreshed every so often whereas TBA is generally a 1 time thing so keep that in mind. Getting re-authorized in some kind of process is going to be the biggest difference IMO.