I agree, for now it's only inbuilt wallet, and Zapping is like hitting like. Maybe in future we will have some better options or primal remove KYC.

The usual way things like this work is they make it convenient to sucker in users then use that in malicious ways. Amethyst does one touch zaps. Coracle.social does also. That's not a feature exclusive to Primal.