It's the responsibility of the zapper to publish the zap receipt, so it's ultimately up to the recipient if the zap is published publicly or not.

The main issue would be that senders have an expectation that zaps are public. Perhaps zapper endpoints could have a flag that specifies if they publish zaps publicly or not to align expectations.