Yep, but if people don't check where each individual zap is going then who knows which wallet is actually receiving them. A malicious client can create a zap for A to receive but with B's address.