You can also have a zip that decompresses to itself: https://research.swtch.com/zip

I mean "mild" bombs where the final output bytes looks normal, a regular sized image, but the decompressing steps takes unnecessarily long, eating CPU or/and RAM