Clearly, they're just making a point here, hurting developers and users just to spite a regulator.
What they are signalling to me as a developer is that mobile devices are just not a reliable platform. Better do as much as possible on the server.
However, I'm on their side in this case. I run a business. If having a feature comply with some regulation meant implementing a whole infrastructure I don't have to serve a minority of customers, I would also abandon the feature.
They could have implemented this feature securely, but they chose to use the opportunity to make a point instead.
All other OSes support web app installation from any browser, including macOS. This is a lot more secure than installing any native app.
This is just Apple spreading FUD as an excuse to keep preventing web apps from competing with native apps.
That's always how they spin their FUD. They already have an app sandbox in place for all fo their apps. Sideloaded, PWA, or not.
Evil does indeed lead to real security and privacy concerns.