I wonder how many people install PWAs on desktop platforms. I only ever use them on mobile. I wonder if that would impact the feasibility of such attacks