At any rate, it's not clear to me that granting hardware permissions when you install a PWA is any better than letting the user choose what permissions to grant when you first visit a page. If that really is how it works, maybe alternate browsers will be able to improve over Safari's permission model too.
> it's not clear to me
So, you may not have watched normal users operate a web browser. But... they click on everything in their way. This is why, for example, most "malware" calls I get are just dozens upon dozens of Notifications API permissions being granted in Chrome to random websites. The best way to fix this is... just destroy the Notifications API as a thing, it's a terrible idea. But the next best way is to ensure access to it is limited to contexts where it's obvious a user is interested in persistent communication with a given site or app. Like installing it.
At any point where you thought "just asking the user when they first visit the page for permission" was an adequate concept, you were wrong. And most malicious websites abuse this wrongness ad-nauseum, to the point that browsers now include ways to block websites from making repetitive requests as a attempt to fix it without fixing it.
Firefox has a pretty good record, and I consider their standards positions (https://mozilla.github.io/standards-positions/) the gold standard. iOS/Safari moves a little more slowly, but generally aligns with good practice.
Google and Microsoft are the two companies everyone else (including Safari) is significantly improving over by actually paying attention to how real users interact with the Internet.
For the clueless user, nothing has changed other than which button they obediently push. For the savvy user, you've added an arbitrary special case and a hoop to jump through to get the functionality you wanted in the first place. Neither case is improved in the end.
These security excuses are bullshit and that does include PWAs.
Which isn't to say that Apple isn't playing malicious compliance hard, the entire CTF thing is ridiculous and demonstrates how desperately they do abuse the claim of security when it is actually all about profit... but the PWA thing isn't really part of that.