I get the exact opposite impression. Not just due to these bugs, but also the hidden webserver thing [1] a while back.
Recurring theme in this (the webserver and the installer issue) seems to be an unhealthy obsession with reducing the number of clicks the user needs to perform. They deliberately chose dubious, hacky solutions over doing things the right way due to this. It makes you wonder what other bad decisions they made in the client or server code.
[1] https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-s...
The dodgy things they've been doing suggest otherwise.
* Hijacking package preflight script rather than standard package installation mechanism, so their software is installed before the user clicks Install.
* Installing a hidden web server without user consent.
When you make weapons technology (as SpaceX does; rockets are weapons technology) and are involved in launching military satellites (as SpaceX is), you kinda have to take security issues seriously.
Large part of, if not entire, Zoom engineering is based in China, so just based on that singular fact IMHO this is not at all a knee-jerk reaction.
Add to that numerous security found in Zoom just over the last few days, and I'm surprised why more companies are not doing the same.
The senior people are all in the US though.
Zoom has a pattern of abusing users' trust. Ok, maybe its not intentional, but increasingly, that doesn't matter in security discussions. The fact that it was unintentional is a concern itself. Maybe they lack discipline, or leadership, or something; I'm not asserting to know. But, its no longer good enough to simply say "we're sorry, it was an accident".
> The FBI’s Boston office on Monday issued a warning about Zoom, telling users not to make meetings on the site public or share links widely after it received two reports of unidentified individuals invading school sessions, a phenomenon known as “zoombombing.”
They have what is commonly referred to as form.
Consider the past year's highest voted stories whose title includes the word 'zoom'
https://hn.algolia.com/?dateRange=pastYear&page=0&prefix=fal...
This is certainly not a 'knee-jerk reaction' to the use of the Facebook SDK, but presumably extrapolates from the history of false uninstallation, insecurity by obscurity, false advertising, etc.
Each of those things has been, as you intimate, patched or resolved -- but does that give you increasing or decreasing confidence in their product and priorities?
No, it does not; 9to5Mac is just playing a game of telephone from the original blog post and the actual issue only requires code execution on the machine.
The supposed root exploit found in Zoom also requires physical, logged-in access to the machine, at which point a Zoom exploit is the least of your problems [2].
Zoom is a solid piece of software, and the developers are responsive and seem to care. I'm disappointed to see it getting dumped on during the past few days. A cynic might even suspect a co-ordinated campaign by Cisco, considering Zoom was started by frustrated ex-Cisco employees and has had runaway growth during the viral crisis, while the same cannot be said for Cisco's competitor product WebEx.
[1] https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebo...
[2] https://9to5mac.com/2020/04/01/new-zoom-bugs-takeover-macs-c...