Big thank-you to Apple on this--treating this Zoom "feature" as the malware it is, and using OSX's built-in antimalware functionality to disable it is the exact right move.
This whole fiasco is tremendously disappointing to me, because we do a lot of teleconferencing at work, and of the Zoom-Webex-GoToMeeting trio that I see by far most frequently among businesses we associate with, Zoom is far and away the best. It's easier to use, has a much better UI, better sharing and conferencing features, a better iOS app, and much better audio quality. I enjoy hosting Zoom meetings compared to Webex, which always feels clunky and uncomfortable (not to mention I can never understand anybody due to garbage audio quality).
All of which becomes a moot point when the company is installing malware on users' systems, avoiding even the most flimsy security patch until the last possible moment, and then calling it a "feature" when called out.
What particularly worries me is that the larger org that we're under has a Zoom contract, but our project partners are probably not going to feel comfortable accepting meeting invites from us now, or refuse to do anything but use a call-in number. It's entirely possible some of their IT departments won't even allow them to run Zoom (one already didn't), so it won't even be an option. If the org doesn't ditch Zoom in favor of a different provider, it may genuinely affect our ability to host meetings.