Thank you for the reply! I was just re-combing the code and came to this conclusion as well. Good to know I'm not crazy. I also noticed that your yarn.lock has two versions of nostr-tools, just something I noticed.
Perhaps verifying metadata (kind0s) and other select events is a good start that could go easier on perf. Followed by 10002 and 3. I know that damus still doesn't verify sigs either except for metadata.. this would be the #1 attack vector for malicious zap harvesting. And spoofing follows or relay lists could also be fairly nefarious.
Having to trust relays is a centralizing force for nostr and having major clients skip the verification, makes the outbox model un-reachable and clients wary of supporting the relay ecosystem at large.