> I don't mind if an application I explicitly launched as an application asks to make Bluetooth connections

The security model for a desktop-installable 'app' is a superset of a webpage. Or at least it was in Firefox OS, where additional permissions were required for accessing the filesystem or hardware APIs. In this way they were not available to websites to hijack the in-browser sandbox; the system web browser was itself a 'browser app' with a restricted set of permissions.

(I presume it's similar in Chrome OS, while this blog post is in the context of 'appifying' Windows desktop outside the browser.)