Well that's the thing, to build the utilities required extra flags which were pretty rarely enabled. You can, in most distros, ultimately install minizip as a separate package but few do. It's not that useful of a utility. Most people will likely just grab the full blown "zip" application https://infozip.sourceforge.net/Zip.html . Though on linux, even more people are simply using tar with a zlib extension. That's the `tar.gz` files.

if the tool isn't ran it can't be exploited

CVE should just be far more granular instead of flagging alert for anything using zlib

You do not run it as root, all you get is the possibility to crash or execute code. Nodes that handle such things are all heavily locked down.