Yeah, the monthly lightning spend limit is like $1000, right? That's probably big enough for it to be worth doing for most people.
They could easily enforce a policy against payments to your own CashApp account; but spinning up free Strike account (for example) to subvert that would be easy enough...