Zip bomb?

Doesn’t that tie up a socket on the server similarly to how a keepalive would on the bot user end?

I don't think so. The payload size of the bytes on the wire is small. This premise is all dependent on the .zip being crawled synchronously by the same thread/job making the request.

What if bots catch on to zip bombs, and just download them really slowly?

https://en.wikipedia.org/wiki/Zeno%27s_paradoxes#Dichotomy_p...

Their objective is not to DDOS websites, if they catch on, they will download it fast and then discard it.