Any client is just 2-3 subtle bugs away from doing that and then it's just matter of someone noticing. I think my preference is that the wallet creates a dedicated sats account that can only be used for zapping and is somewhat limited in max sats. And once in a while it would notify me to refill it. Then the potential \total stolen amount\ would be limited while the experience would still be top notch.