This is something i do alot, but something has occured to me.

I use file manager to upload the zip package to the server, its much much quicker that way, i then get the server to unpack, again its quicker.

After install i delete the install file as you should. I also delete the zip package, i wonder how many people leave the origanal zip package in the folder? I have no idea if this would pose a risk as its technically inside composr at that point, but its something to keep in mind if you install like I do, make sure you delete the zipped package as well as the install file after installing.

Should be fine, nothing can run from inside a zip, and remote users can't trigger an unzipping operation, and linking to it would just download the zip as a file.

But it is a wasted few Mb of server space it takes up. Some small shared plans squeeze you size wise.