Obviously, those considerations must be considered. However, as I said, adding a simple confirmation prompt would be plenty enough.

I think what is happening here, is that Apple is going like, "I don't get my market control, you don't get your shiny new features." Other phone platforms allow you to do things, that may be unsafe or insecure, but still plenty useful.

Also, running a PWA really isn't that unsecure/unprivate as visiting a website. They both can access and ask for the same information or permissions. Really not that different.

By your logic that PWAs are unsecure, then should iOS not support rendering webpages due to "security concerns"?