Browser extensions aren't web apps. It's a definitional thing. The whole model of the PWA is that it's an app implemented using only the fixed set of features, authentication and authorization mechanisms defined by the relevant standards, and thus requires no human to specifically audit and permit the installation. Anyone can put up a web app and run it on anyone's device, and we're all safe (modulo bugs).

Extensions can in principle do anything the browser can, like snoop on traffic with foreign sites, etc... They have more capability (for good reason!), but require some level of authorization to happen by the user and (usually) OS vendor to make sure nothing bad happens. And bad things happen anyway.