Any client is just 2-3 subtle bugs away from doing that and then it's just matter of someone noticing.
I think my preference is that the wallet creates a dedicated sats account that can only be used for zapping and is somewhat limited in max sats. And once in a while it would notify me to refill it.
Then the potential "total stolen amount" would be limited while the experience would still be top notch.