Hrm. Would how this be related? 

 NM. I see how.

nostr:nevent1qqsgktx7rrf7m53cpfjs3sfyxdw625lqafam66jhzft5rpnxufrpe8spz4mhxue69uhhyetvv9ujuerpd46hxtnfduhsygpnp7c5x8lemrp9qurthnwqzm25jk3lw38qg7jqs9e7j2h8aepd4spsgqqqqqqse4z009 

 with 11 relays and let's say a relay URL is ~20 characters long that's then 220+ bytes in the zap request. that still should be good, I've seen muuuch more than that. 

Alby Hub for example also returns that metadata in the transaction list and as the whole transaction list also has a size limit (as it's just a nostr event) a lot of transactions with big zap requests can become an issue there, too.  

 This makes sense and as you said, this could be seen as an attack vector.