Firstly, these powerful features are not available unless your site is properly (I.E. fully, absolutely nothing can be plain HTTP) protected by HTTPS. You cannot even create service worker without working HTTPS so any kind of PWA is out of question without HTTPS. Secondly, any browser that supports these capabilities also supports Content Security Policy which makes your site trivially immune to XSS and I expect that it will sooner or later become required to get access to the powerful features, on top of HTTPS. Thirdly, any powerful feature is behind a permission that is basically as hard to obtain as the consent to install an app in the first place.