What are the anti-abuse features built into this? Can Apple disable push notifications if the website gets hacked and is actively stealing people's info?
No, and previously you could add a hacked website to your homescreen and Apple couldn't stop you from doing so. Not speaking for the other features, but the webpush api provides no mechanism to steal info as much as it provides a way to alert a user who previously installed the app and allowed notifications that the app is sending them a notification.
Now, if after the user installing and allowing, the site gets "hacked", the hacked site operator could send push notifications that invite the user to interact with the compromised web site/app. Apple has no recourse; the pressure would have to be applied to the hosting service to shut down the site. That's a tall order for your average web user.
As an aside, how would a notification steal your info?
How about:
“Hey dear user you won {amount} of money please click here and fill this totally safe form”
This was me thinking for a solid 3 seconds, imagine if someone put some effort into the message.
It's unclear if they can do it for a compromised website, which was my question above.