"Because a progressive web app has a more intimate user experience and because all network requests can be intercepted through service workers, it is imperative that the app be hosted over HTTPS to prevent man-in-the-middle attacks."

Nicely written and layed out, though I would suggest to add a point that describes not including 3rd party hosted resources to prevent leaking user activity at third parties. Other way described, host all resources on your own site/url.