you need to "install" the PWA first. So how's this different from regular desktop applications in regards to phishing specifically? Do you mean an app presenting pre-"install" as something and then post-"install" as something else?

I'm having a hard time seeing a lot of difference. Most windows you want to "spoof" will look different in regards to the title bar either way. In a regular browser window you'll have the browser title bar. In the PWA case you'll have the extra hamburger menu.