This is where clients should implement rate limits set by the user, but ultimately users need to only keep in their custodial wallets an amount they are comfortable parting with whether it be due to zaps or malicious actors.