I know that "legacy ZIP-crypto" is not secure and you can get at the contents of the file quite easily.
Now the question is, can you also get at the password (assume this is a very long, very high entropy password)?
A colleague has actually managed to use one of our "high security pass phrases" for encrypting a ZIP file and sending it out to a third-party e-mail system. Are other containers, using the same passphrase, secure, or could someone, who fetched that ZIP file, "extract" the passphrase from it and then move on to decrypt other, higher-security containers with it as well?