[chrisseaton]

Do you have auto-run enabled for downloaded files?

[revvx]

Nope. Not even for safe (image, music, etc) files.

And even if I had, PKG files don't install themselves on macOS, they open the installer interface, AFAIK.

EDIT: And, as I mentioned, the file was downloaded by some Zoom client, not by my browser.