That’s unfortunately an expected issue…
As php7.2-zip is available only from a pinned repo, it will be installed as required, but its dependency of libzip4 will be from the standard repo, as this package exist in debian repo.
You could probably find a upper version of this package into the same pinned repo, but apt won’t take anything from it unless it’s clearly asked.
In such a situation, you have to ask explicitly for this package in the version you need.
libzip4=1.3.2
Unless for this repo, it would be libzip4=1.5.1-4+0~20190318173229.9+stretch~1
I guess it would help to have a helper for that as well…