For anyone interested, I put this question on ZA's forum and received the following reply:
"Actually your ZA firewall engine (vsmon.exe) is one of the very first services to load in the boot sequence. What you 'see' loading is the Zone Alarm control panel (zlclient.exe) which does load after some other applications. Worry not, you are protected from the getgo."