Also what are your thoughts on malicious nostr apps that steal everything as soon as you login?

yes, they are compatible -- with this, if you try to zap someone that doesn't have a cashu wallet announced it will do a regular bolt11 zap from the cashu balance (how cool is that?!) yes, these are pubkey-locked cashu tokens, locked to the pubkey of the npub with a "02" prefix for parity so the proofs are actually unencrypted, anyone can verify them, but only the recipient can swap them