Zap Receipts also include testnet sats.

And the request and receipt can reference a pubkey for person A while the payment goes to the lightning address of person B.

Or a simple rogue implementation can just spam out fake zap receipts

The source of truth is the receiving node, which only you (or your custodian) have.