That request really kinda falls into "let me google that for you" territory, but, you know, here you go:
https://webkit.org/blog/13878/web-push-for-web-apps-on-ios-a...> it's not clear to me
So, you may not have watched normal users operate a web browser. But... they click on everything in their way. This is why, for example, most "malware" calls I get are just dozens upon dozens of Notifications API permissions being granted in Chrome to random websites. The best way to fix this is... just destroy the Notifications API as a thing, it's a terrible idea. But the next best way is to ensure access to it is limited to contexts where it's obvious a user is interested in persistent communication with a given site or app. Like installing it.
At any point where you thought "just asking the user when they first visit the page for permission" was an adequate concept, you were wrong. And most malicious websites abuse this wrongness ad-nauseum, to the point that browsers now include ways to block websites from making repetitive requests as a attempt to fix it without fixing it.
Firefox has a pretty good record, and I consider their standards positions (https://mozilla.github.io/standards-positions/) the gold standard. iOS/Safari moves a little more slowly, but generally aligns with good practice.
Google and Microsoft are the two companies everyone else (including Safari) is significantly improving over by actually paying attention to how real users interact with the Internet.