Earlier quoted context omitted.
Nope, it's much more insidious than that. The user is already on your website, which could be a legitimate website with a malicious owner. If you look at the screenshot, it's a perfectly valid interpretation for a non tech-savvy user to interpret that as "realhealthysnacks is asking me to install a legitimate Microsoft application". Now change the simplified example for a real one from a SaaS product login page with…
> legitimate website with a malicious owner. What... does that mean? A website with a malicious owner is illegitimate by definition. :) But more to the point, this logic is circular. You're saying PWAs are subject to attack by malicious actors because their users can be attacked by websites controlled by malicious owners. Which is... true. But specious, and true of regular web pages and apps and every other kind of s…
One of those imperfect solutions is training users to always check the URL bar. PWAs let the attacker inject a fake URL bar AND hide the real URL bar.