This is a great summary of the ongoing issues, it however does miss a few things. Including a security vulnerability in their lobby feature that has privately been reported to Zoom by CitizenLab the other day - and which still needs fixing.

The crypto part is really bad, because it seems potentially malicious even.

Has anyone done crypto analysis on the pwd= query parameter? Knowing their security skills I'm wondering if that is crackable...