I researched this a bit more and found that Mark Adler patched this in his fork.
See <https://github.com/madler/unzip/commit/5e2efcd633a4a1fb95a129a75508e7d769e767be> and <https://github.com/madler/unzip/commit/5c572555cf5d80309a07c30cf7a54b2501493720>.