SharePoint Protect files on download loophole?

I've created a CAS policy to "Control file download (with DLP)" on for Guest users. I have the policy set to apply a protective Sensitivity Label and to "Block download of any file that is unsupported..."  

This works fine when trying to download individual files from SharePoint. However if I select multiple files, SharePoint zips them all up and downloads the zip file with no protection on the zip or the files within the zip.

Is this a bug, or am I missing something?  For now I've created another policy that blocks all zip files from SharePoint as a workaround.