Earlier quoted context omitted.
The standards only really define what should be done at the interface or what the function inputs and outputs should be, but don't really define the internals of the functions. For example inside of a malicious approve function call, you could hardcode a list of popular addresses that also approved those tokens if the msg.sender is holding (balanceOf calls) them and even potentially then have transfer functions calls…
Both of you are wrong. ZK fundamentally does not allow to hide the rules (the code). It only allows to hide particular executions. So yes, while you can have an ERC20 interface and some censorious garbage inside (I look at you, USDC), you can't hide that fact from observers.
Did you respond to the right chain of comments, none of us mentioned anything related to ZK solutions (chains line mina or rollups or otherwise)?