There was plenty of criticism before. Remember they were the company that ran an unauthenticated web server bound to localhost so that any website could make requests to it and get the video stream. And they made it so that an uninstall wouldn't remove that.
That was July.
https://www.schneier.com/blog/archives/2019/07/zoom_vulnerab...