They would be running in a browser, and you can just deny it getting location information, but in general, apps have access to much more raw data than a tab in the browser does. It's also possible, in theory, to run a PWA in a different browser which masks your information.