It says that it only allows postMessage for cross domain communication.
BUT I'm concerned it doesn't mention similar sandbox and feature policies as iFrame. It also mentions that it will allow the 'child' to know if it's inside a portal with window.portalHost but at least this github mentions you can minimally declare no-referrer https://github.com/web-platform-tests/wpt/blob/master/portal...
Wouldn't the concern be ads ( I assume this is what this feature is intended for especially on mobile )? If there are no similar restrictions as a iframe safeFrame I can see a ton of ad scams that take advantage...