Words of wisdom.
There is no way to ensure a zap matches an actual payment.
At best, it can loosely represent a payment if both sender and receiver are honest. But then, they might as well use a more private payment method, like LNURL.
I suppose the best scenario zaps can aim for is an honest receiver + a fixed enough zap protocol, such that senders cannot fake it. Then build on top.
But IMO that comes with so much downside (centralization, newbies seeing zaps as LN standard, newbies being scammed by receivers who fake their zap counters, etc) that its not worth it.