That one time it happened to me, Chrome screamed at my at the time of downloading. I knew it was a virus, I just wanted to see what it looks like on virustotal. Was an obvious one and uploaded to Itch. So I was curious, why Itch's scanners did not detect it. It turned out to be even more ridiculous since even Chrome screamed at me. Or maybe it was the Defender. It was not distinguishable for me at that time.
If it is actual zip files, that is strange. Maybe compressing Godot files makes them look suspicous. Godot packed exe often trigger. They do clever things inside that. Zipping it again might be seen as a circumvention method.