The problem with having those APIs in the browser is that it increases the attacker surface area, which makes the browser less secure for everyone, including those who do not use PWAs.
The only saving grace is that you have to accept the permission box (I hope so at least...), which, for the average user, may not be much protection.
