Regarding security, the unique thing about this is that PWAs are dynamically loaded and updated from the distribution site which is typically any arbitrary website. The question then is the website in question and the server it is on secure. Seems like this is the downside of PWAs, not distributed though a normal distribution channel which has some extra security and controls. Not sure an arbitrary website is that secure just in general. Do not know either way.
The rest is same as using any app that you did not write and audit. Do you trust the author and an app without a lot of history? Not saying anything bad about this PWA. In fact, it is developing a lot of good feedback so probably fine. Who can tell for sure about any app for that matter.