There's nothing sketchy going on, it's just that people do sometimes use the classic ZIP + EXE to deliver malware and even when you're doing nothing wrong it can get flagged by security tools.
