In practice, service workers seem to mostly be drive-by installs of forms of hostile code. Look at "about:serviceworkers" in Firefox to see what's running. Did you ask for any of those? I have, excluding sites where I have a login:

* https://www.youtube.com, https://plus.google.com I've never signed into Youtube, or Google, on this machine, but have watched YouTube videos.

* https://www.bajajfinserv.in - A financial service in India. I was checking out something from Wikipedia, and this drive-by installed.

* https://www.theguardian.com - I've read their site, but do not have a login.

* https://weather.com - checked weather, don't have a login.

* https://v6p9d9t4.ssl.hwcdn.net - No idea what this is. Going there returns XML with "<Message>Access denied.</Message><Details>Anonymous users does not have storage.objects.list access to bucket itchio.</Details>".

* https://fee.org - "Foundation for Economic Education", a right-wing think tank. Does a drive-by install for any home page access.