If it didn't, malware devs could just send malware zipped in a password protected folder with that password and tell users to enter that password to unzip.