VM have compared their policy to googles as a seperate thing.
the same VM policy applies to SMTP too.
Googles policy on passworded zips is
If the attachment is encrypted and does not contain another zipped attachment, then it can be sent and received.
VM are saying that they can't be passworded at all.