I may not be entirely right about this, but I believe that Gatekeeper relies on xattr to mark files as quarantined. This is a feature that I wouldn't expect to

I may not be entirely right about this, but I believe that Gatekeeper relies on xattr to mark files as quarantined. This is a feature that I wouldn't expect to be available when mounting non-Apple filesystems. If this is the case, a potential solution is to track external mounts and to prompt a user when accessing a new drive for the first time, especially in the case that the OS has read or written a new symbolic link pointing to an external file system. I agree with other commenters who say that the NFS auto-mounter should likely default to off on fresh installs. If there is a concern about this breaking enterprise configurations, set NFS to default into a prompt before mounting mode. As far as the issue of symbolic links in zip files, I'm not sure there's much to be done (except perhaps issuing a warning that would be difficult for most users to parse). I mentioned elsewhere that this functionality is not unique to macOS or to zip. The final issue that I see is that Finder hides so much metadata (which could be useful for a reasonably sophisticated user). I'd like to see a prominent indication of a cross-filesystem symbolic link. Likewise, it'd be worthwhile to have a clear visual indication when browsing a remote file system.