Unfortunately there is no other way for PWA web apps to receive data back from Amber without reading the clipboard. Once you grant noStrudel permission to read the clipboard I believe it has to be initiated by a user action (ie. click or type) more info here

User activation - Security | MDN

To ensure applications are unable to abuse APIs that can create a bad user experience when the behavior is not desired, some APIs can only be used ...

But it could effectively read the clipboard whenever it wanted