Browsers can still do that. It's more that PWAs look like entirely separate apps which the user would expect to be sandboxed. While a tab in a browser is clearly part of the browser app.
This is not a meaningful distinction. Users ALSO expect ordinary websites’ data to be sandboxed. Users trust that pornhub.com won’t be allowed to read data entered into irs.gov.
> Users trust that pornhub.com won’t be allowed to read data entered into irs.gov.
Likely, most are worried about the other direction.
There is also a brand rep issue. If there is a Chrome bug that leaks data, it will be seen as a Google issue. If PWAs have the same problem, it will be seen as an Apple security issue. One that they have no ability to fix.
If I gave camera permissions to the zoom website on my browser, it is way worse if a random malicious email link gets them too on a different domain than if a permission spreads across PWAs I hand installed. This is Apple shaking people down.