Well its all async, there's no reason why an app couldn't make many concurrent requests at once, like when decrypting 100 notes.

It maintains a queue of requests (which contain promises that get called on approve/deny). The auth window gets updated in realtime, and then there is a button to lock-in and review incase they try to add something at the last moment without you noticing.