> The alternative would be that anyone could send notifications to an app
No, the alternative is that anyone with a password the app generates can send notifications to any app, which is (effectively) how WebPush and UnifiedPush work. The server that knows the secret URL can send a notification to that website or app.
No, the alternative is that anyone with a password the app generates can send notifications to any app, which is (effectively) how WebPush and UnifiedPush work. The server that knows the secret URL can send a notification to that website or app.