You already got the correct answer from BitMaxz: zpub is a public key; people that have it can see your addresses, but can't spend your funds.
It's a master public key if someone has access to this then they can only see all of your addresses on that zpub but they can't make any transaction.
This is not entirely correct - See ranochigo's reply above and also
this thread.
Publishing (or leaking) a derived address/privkey pair allows anybody to use the master-zpubs to generate the master-zprivs and with that, any private key that can be derived by the master private keys.
Oh well I was under the assumption that nothing except that master public key was leaked. I know about that unfortunate bug; anyone should sweep their whole wallet if they know a single private key got leaked (though I don't see how leaking a private key should happen if you have your opsec in check).