Comment Service workers were the real flaw (Score 1) 45
A service worker shouldn't just 'run' automatically without any user prompting (certainly not the hundreds I have on my box from every single news and slop page I've ever clicked which I have to go wipe out every few months).
They were for web-apps and should only be installed when the user installs the web-app or actually approves notifications. You can say "no notifications" but the service worker will still get installed. This is just a fundamental design flaw that's been there for as long as the SW feature has.
I mean, that doesn't still mean that under better installation security, SWs couldn't still exploit a flaw like this, but it would make it less automatic.