An example of something that Zope doesn't seem to do nearly as well as the ACS is how they're development community seems to keep in touch:
http://www.zope.org/Resources/MailingLists
I don't think they do it nearly as well as we do hear. If there are ways of doing it better in Zope, I don't think they make a very striking case since they don't use it themselves. Although they do give you a link to eGroups (ech).
If I may volunteer them, I would ask Petru Paler and Kapil Thangavelu
to comment a little in this thread about some of the differences, strengths and weaknesses between Zope and ACS. I know they are both familiar with these systems.
Also, Jon, can you elaborate some on the security flaws in Zope?
talli