Bluetooth does have privacy issues, but again, that's no different than a native app. If I install a native app, it doesn't get free reign over BT or any other device feature. In order to use any hardware feature a native app has to request permission to use it. I don't understand how a web app is any different in that regard. A PWA could specify the features it wants to use in the manifest.json just like a native app does with the Info.plist. Then iOS could prompt the user in the exact same way. If the iOS permission system isn't a good design (I think it is) then why do they keep using it and expanding it for native apps but not use it for PWAs.