TWRP 2.8.7.0 -> How secure does WIPE erase your personal data

• From official TWRP

For instance, if you're getting ready to sell your device, then it's a good idea to wipe everything on the device so that the new owner doesn't get your private data. Note that these wipe options may not be completely destructive. If you store especially sensitive information on your device or are really concerned about your private data, then you may need to look into other options to ensure that your data is fully destroyed.

So, TWRP wipe isn't the best way of you are especially sensitive to personal information being captured

• Recommended way is to encrypt and factory reset. A factory reset by itself is supposed to overwrite information but it has been shown that it is not 100% true always - some parts of storage are marked as overwritten but in reality aren't. If the phone is encrypted

....If the phone's hard drive is encrypted, any unerased data will be scrambled and effectively useless

This was established in a study two years ago , details here

Edit Thanks to Izzy who pointed in comments another important aspect of FRP(Factory Reset Protection)- make sure you are signed out of your Google account before doing factory reset. Else, this protection will kick in and you will have major issues at hand. Also refer to tools in his curated collection linked in the comment for secure deletion