There needs to be something in the protocol that allows them to specify this. I believe the zap privacy is just about whether the client posts a public note on Nostr that says you zapped their note, or posts a DM, or posts nothing at all. And I'm not sure how that last option differs from anonymous.

That's not just a Damus thing, either. It's in Amethyst too, and I suspect is a defined standard somewhere.

A NIP saying note type XYZ is for notes that can't be shared (boosted, broadcast, etc.) but are otherwise to be treated like type 1 notes.