At the end of the day, when accepting these payments the only way to truly verify if it’s legit is to redeem it to your lightning node. For the offline mint case you could really only do that with a whitelist of mints you trust, which isn’t actually that bad.

that's true, but being trustworthy is a very achievable thing for mints.

With Cashu 402 the merchant / receiver decides which mints are used to pay. So you choose mints that you have some trust in.