I wouldn't call PWAs universal platform when they are very dependent on Google being nice with Chrome. Also, browsers already have integrated blocking mechanism that is supposed to block out phishing sites etc. but that's only the case because so far the browser infrastructure operators(Mozilla, Google, Apple) are acting nice. The Push notification infrastructure is also possible only because the browser infrastructure operators are being nice so far.

At any point Google or other browser makers can choose not to be nice or can be compelled to follow regulatory orders.

The only universal thing about PWAs is the availability of Google Chrome to all major platforms and that's up to the courtesy of Google. They may choose not to do it at any time, they may choose to discontinue their push notification backend just like that.

Browsers are not standalone apps anymore, they are dependent on the backend services of the browser company. That's especially important when they need to run PWA.