so does an app

Exactly. The only app-specific abuse I can think of is apps that wake in the background (Apple said this isn't the case, but it is), Android where apps get push by default, or apps that just hope the user will grant broad permissions that web can't do.