Keeping your autostart directory read-only is a great idea.

After that, a ZIP symlink traversal could still drop a script in your command path directories that are writable by your user. The execute bit is not a hurdle, unzip utilities will typically preserve the execute bit on Unix systems.

ZIP directory traversals are as old as the hills, yet they are still a thing: https://snyk.io/research/zip-slip-vulnerability.

ZIP symlink traversals are even more powerful, yet they are hardly spoken of.

Ideally, you want your email provider to be blocking ZIP attachments with symlink traversals or execute bits (but I am not aware of any which do).