I haven’t used zapstore, but someone has to trust the source.

„Open, permissionless app store powered by your social graph“

implies to me that this someone must be you or your social graph. So, I guess non of your buddies has installed this app.