Unlike with iOS or Android, in HTML5 invasive APIs (including notifications) are all opt-in. Each permission is granular, instead of needing to choose between granting all permissions an app requires or none. IMO this is a massive improvement.

Although you could grant notification access to an app and then it could become a bad actor, I expect on the web you will be able to be far more choosy about granting access than with an app.

I believe Android is doing something to bring in granular permissions, there was discussion at Google I/O this year.