Good news! You'll only get notifications if you save a web app to your homscreen and then explicitly give it permission. And then you can choose to limit it to only badging, as with native iOS apps. Or you can use focus modes to manage which notifications you can get in different situations, as with native iOS apps. We've been careful to minimize the risk of notification overload as much as we can.
I'm glad that there's controls in place to help minimize the issue, but I also know that companies do a good job of making people think that they need to enable settings on their phones that they don't.
That's of course not in Apple's control, it's just a meaningful downside to opening up push notifications to web apps on iOS. The utility for the few apps that can really benefit from this probably outweighs the downsides, but I've seen other people's phones and know it will also, and possibly mostly, only contribute to more spam.
