[autoexec]

> Webapps are already protected with the same privacy and security protocols the browser imposes on webpages

You can disable commonly abused/exploited things like service workers and still use most websites just fine, while a webapp might depend on having that functionality enabled reducing your security when using websites and webapps.

> What can a native app possibly do that's such an egregious invasion of privacy that a webpage can't do?

Harvest your contacts? (unless that's changed)