My little story:

I recently replaced my $HEALTHCARE_APP with the PWA of their website. It was the *exact* same. The app was just a webview (and a pretty good one at that!)

It makes me really question how much “security” these services need when they have websites that can do everything the app can do.