I wonder if the next obvious attack - 2 pushes in rapid succession, one to show and one to hide - has been handled. The browser should debounce and replace the notification with a notice instead of hiding if it’s removed too quickly. Human time scales.

Also no mention of Firefox in the article ;(