We haven't seen a Zoom log found in an open S3 bucket yet, or a leak via fb, but experience says that it is only a matter of time.
So if you're going to mandate Zoom, own the risk. Mitigation is possible: provide recorded streams for secured download (if safe/ethical/notified to record other participants!); provide a work laptop with a non-identifying config instead of a BYOD; many other options.