I’m not saying this is good security hygiene, but not necessarily everyone with access to the file will also have access to the password in the email.

e.g. someone downloaded the password protected zip on a public computer, logged out of their email, but forgot to delete the file.