Hi, I'm uncertain if this is a known issue, but the media uploader will throw zip files into the gallery, and then provide links to the zip files via the gallery.
This was an accidental discovery on my part when I mistakenly tried to upload the same plugin twice. In the plugin screen, I received an error message to the effect that process failed because there was already something in the directory (some error message to that effect) --which was fine, I realized my mistake, and moved on to upload the proper, second plugin.
Later, I went to the media gallery and saw the plugin listed as one of the gallery options. I was more than a little surprised, and pretended I was a confused user trying to install an image into the page. The net result is that WordPress put in a link to the zip file in the page. When I looked at the page, it was an attachment, of course, and when I clicked on the attachment, it actually took me to the location of the zip file itself.
Can anyone replicate?
I am extremely reluctant to open any of the galleries to users for them to maintain themselves if it is possible to open zip files through the gallery.
Again, thanks for the awesome work of the WordPress team.