Last time I checked content blockers already seemed to work in PWAs, but there was no way to disable them.

Ideally, of course, Apple would allow PWAs to use different browser engines and then competing browsers could add support for extensions in PWAs.

It is possible, but unlikely.

Apple will give per-app prompts for system resources like location, but does not really have an iOS 'app prompts for permission to manipulate another app'.

These sorts of permissions are confusing to users, they imply an execution model where both apps will be guaranteed to be runnable side-by-side (rather than one suspended while the other executes), and provide efficient vectors to share privacy/tracking information across those boundaries about the user.

Browser extensions aren't web apps. It's a definitional thing. The whole model of the PWA is that it's an app implemented using only the fixed set of features, authentication and authorization mechanisms defined by the relevant standards, and thus requires no human to specifically audit and permit the installation. Anyone can put up a web app and run it on anyone's device, and we're all safe (modulo bugs).

Extensions can in principle do anything the browser can, like snoop on traffic with foreign sites, etc... They have more capability (for good reason!), but require some level of authorization to happen by the user and (usually) OS vendor to make sure nothing bad happens. And bad things happen anyway.