To add to what @Torsten and @jormond said, Zoom eventually (admittedly very late given how serious this problem was) changed its position and patched their software (removing the web server and changing default settings if I am right).
See the following articles for updates to this story: