"User agents must not provide Push API access to webapps without the express permission of the use"

I share your concern. but I share a great fear that web apps will become increasingly irrelevant if they remain just documents that can't do anything when they're not explicitly in a running tab/window.

The permission requirement is the same one that allows for local storage, which could have caused great problems, but has so far held up well.