[giaour]

> That is obviously a very hard problem with only imperfect solutions.

One of those imperfect solutions is training users to always check the URL bar. PWAs let the attacker inject a fake URL bar AND hide the real URL bar.