bash is the problem, the solution to this madness is to not use bash.
Only difference is that it does not source .profile unless it's in compatibility mode (invoked as `sh`)
/etc/zshenv is always sourced, and there's no way to stop that. On the other hand, you can control if /etc/zshrc (etc) are sourced with:
unsetopt GLOBAL_RCS
IGNORE_SYSTEM_ZSH=1
But you would have to put it in .zshenv for it to get sourced at the right time.The details and decision tree of zsh's initialization are rather well documented already (if complex) and beyond the scope of making that point.