IMO the only way those notifications should be allowed to even be prompted for is after pinning a site to your home screen.

I’m not sure if iOS does this for any other permissions, but it would be natural to allow additional prompts for access to APIs that are otherwise banned - based on if the web app is pined / “installed”.