>Browsers also could install web apps on the system without a user’s awareness and consent.
Couldn't this be entirely solved with an OS permission-like prompt "are you sure you want [progressive web app name] added to home screen?"
3 trillion company can implement this without breaking a sweat properly if they cared, what are they trying to say here - 'we are incompetent'? Not buying that for a second, we know they can deliver.
Apple does not.
And if they don't, they have at least a chance of circling back and catching them later.
They want that.
With apps that they cannot review such as PWA apps, they have no such ability.
Why would this be exploited on the relatively small marketshare platform that is iOS, when in all those years this year not been a problem on the dominant platform?
Because it's not a real problem.
This stuff is part of the reason people commit to the Apple ecosystem despite its shortcomings.
While Android dominates globally, iOS has nearly 60% market share in the US and some other countries.
What we are talking about is specifically targeted at the EU where iOS represents about 30% of users, and doesn't apply to the US. So it's unlikely that scammers would just hold off from exploiting Android and wait for the EU to force iOS to allow different browsers, and only then exploit this class of vulnerability.
Android was also infamous for causing users to develop permission-blindness and just accept everything, later replaced by every app havinf an extensive permission list that everyone just shrugs and accepts as normal.
iOS has been doing something very similar and it's arguably worked pretty well.