you can fake the amount/bolt11. The only thing that authorizes a zap is the nostrPubkey (zapper pubkey) on the lnurl server. So it needs to be trusted by you