damus ios has always verified zaps. it also verifies profile signatures so that noone can fake profiles. also when constructing threads it walks nostrdb which verifies all notes. we just haven't completed the full nostrdb migration everywhere yet.