That seems less like them decrypting encrypted archives and more like the zip format not encrypting filenames so they’re easily read from the zip’s metadata.

Which is still a privacy violation, to be clear, but not nearly on the same scale as somehow obtaining and using your passwords to decrypt data you yourself encrypted.