what motivated the design decisions of RFC 8291 ("Message Encryption for Web Push")?
Although it is not forward secure against client-side compromise (i.e. disclosure of the user agent's long term private key), it is forward secure against server-side compromise (i.e. disclosure of all information available to the server).
Thus, for example, if ownership of the application server is transferred from one company to another and the user's trust relationship with the new company is not as strong as the old company, the user still has assurance that their old messages are not compromised.
Bidirectional forward security would seem to be preferable, but the the offline encryption implications of push messaging make this a constraint that is hard to achieve.