I have not encountered a single case where a web app offered a better experience than a native app.
There is a reasonable argument that it's cheaper to develop, allowing support for more platforms to be rolled out with less development time. That's the single reason that might be valid.
For companies with more reliable visitors, Native definitely has an edge in options, but if a company is trying to build feature and experience parity across platforms, much if that edge is dulled.
Twitter PWA: 600KB
Native Android Twitter: 23.5MB
https://developers.google.com/web/showcase/2017/twitter#lowe...
This has been a huge differentiator in countries where users are sensitive to data consumption, which is why you see many case studies about countries in India, Africa, etc. getting great traction with PWAs.
Disclaimer: I'm on Google Web DevRel team
If these catch on a big way, it'll be catastrophic for more underpowered devices. Modern web pages are already starting to get acutely uncomfortable to use on older iPhones, let alone older Android devices- we aren't yet at the point where performance levels are high enough that we can slap the equivalent of an electron wrapper on everything, smirk at users' devices' vanishing battery life and call it a day.
I currently use IndexedDB to store over 500mb of data on phones successfully in a B2B application.
The biggest issue in my experience is access to native "well optimized" APIs. (If I want a video feed, it causes significantly more battery draw to do it in a webview vs a native camera feed).
IndexedDB is subject to the same origin policy, so only javascript executed on my domain can access the data for my domain.
Combined with a good Content-security-policy means I'm in control of exactly what code gets to access those resources.
Any cookies would also be subject to XSS, unless they have the HTTP-Only flag set, in which case the whole point is not worth discussing because JavaScript cannot access it or even know it exists, so it would obviously be useless to any javascript.
Localstorage (and friends like WebSQL and IndexedDB) and Cookies serve different purposes, and having data in IndexedDB is no less "secure" than having it displayed on the page. In both cases an XSS attack means game over.
See link below for per-browser storage quota: https://developers.google.com/web/ilt/pwa/live-data-in-the-s...
Disclaimer: I work on Google Web DevRel