[Zardoz84]

> the browser's control over the button's label text, language, and appearance means it can trust the user's click as a genuine signal of intent.

Like we don't saw fake download bottons imitating the legitime button.

[llbbdd]

Prompting for installation opens a dialog controlled and populated by the browser that has the name and author of the app to be installed. You can test it on the example page here, linked from the article:

https://microsoftedge.github.io/Demos/pwa-install-element/in...

[Zardoz84]

That not avoid you clicking a fake button imitatatin the good button.

[llbbdd]

Right, but it does gate the actual installation behind a secondary approval in a trustworthy prompt that the page author doesn't control. The page author could of course make a dangerous-but-trustworthy-looking app that would pass muster for the user's approval, but at that point it's not any different than social engineering the installation of any regular malware, e.g. convincing a user to download and execute a dangerous binary.