To answer my own question:
nostr:nprofile1qqsqfjg4mth7uwp307nng3z2em3ep2pxnljczzezg8j7dhf58ha7ejgprpmhxue69uhhqun9d45h2mfwwpexjmtpdshxuet5qyt8wumn8ghj7un9d3shjtnswf5k6ctv9ehx2aqnz0fd0 interviewed nostr:nprofile1qqsdmup6e2z6mcpeue6z6kl08he49hcen5xnrc3tnpvw0mdgtjemh0spp4mhxue69uhkummn9ekx7mqpr4mhxue69uhkummnw3ez6ur4vgh8wetvd3hhyer9wghxuet5cq87e5 about npub.cash just a few days ago. I'm listening to the episode now
npub.cash stores the cashu tokens, redeemable by the receiver's wallet when they come online later. And, if I understand correctly, they now use Cashu's P2PK "locking script" (NUT11) such that the tokens can only be spent by the intended receiver. I assume that is whoever has the nsec corresponding to the npub to which the zap was sent