There is a policy in HES for password-protected ZIP files. By default, this rule is enabled and the action is set to stamp, which does not change the current handling of attachments.
HES customers can change how password-protected ZIP files are handled, but HES - Inbound Filtering customers are not able to change the action set for the rule.