`extractall` does mitigate directory traversal. Looking at the source code, both `extract` and `extractall` call `_extract_member` which sanitizes the file paths.

See https://github.com/python/cpython/blob/3.6/Lib/zipfile.py