Seeing discussions worrying about maliciouss zip files is just sad.

Why do users even tolerate that?

It's not as if there aren't implementations of the majority of common compression formats in other safer languages (notably in pure Python). Oh sure, slower than C, but realistically the storage is going to be the bottleneck anwyay so it doesn't matter.