The part that freaks me out is you can’t uninstall it.
“The undocumented web server remained installed even if a user uninstalled Zoom.”
I’m not sure if this is common. Sony got caught with their XCP rootkit (I’m not sure if they called it this at the time) you had to fill out a “uninstall request” form on their site with your email and location. I’m not sure if the uninstaller fixed the vulnerability.
So maybe a rootkit might describe this if the vulnerable webserver is privileged. In Sony’s case, the side effects were unintentional (though their history with DRM is egregious). I think Zoom is just polluted MVP in production.