When you tap the zap button all it does is create an invoice to be paid and send it to your wallet app. If a hacker were to log in with your nsec and try to zap someone it would create an invoice and then send it to whatever wallet app he has on his phone already. If he then paid the invoice the zap would appear to have come from you in nostr, but would have been paid with their own wallet, not yours. Once the invoice is paid then an event is broadcast to relays that says you zapped someone.

I'm not totally sure how 1-tap zaps work though as I've never been able to use Damus, but I think it's still segregated. I don't think there are any nostr clients that have built in wallets that you access with your nsec yet.