Just don't use programs with creepy EULAs.
I recently installed RealPlayer, and took note of the fact that their EULA mentions:
6. FIREWALL CONFIGURATION. The Software configures certain firewall applications such that the user is not alerted when the Software requests or receives data necessary for playback of content over the UDP protocol.
After installation, I checked, and sure enough, ZoneAlarm listed several Real components, with Internet access enabled!
If Real can do it, then so can a virus or any other malware, rendering ZoneAlarm totally useless.
It would appear that this weakness is not limited to ZoneAlarm, but is one that's inherent in all firewalls. Here's what Marc Maiffret, Chief Hacking Officer at eEye Digital Security, had to say when I informed him of my findings (I'm quoting him with his permission):
There is no personal firewall out there that will stop local code from being able to communicate out to the network if it wants to. ZoneAlarm is easy to bypass to communicate out to the world.
The problem is that most other people still believe in things like ZoneAlarm... I can't understand why.
(End of quote)
And there's no easy solution. You can check ZoneAlarm's programs listing to see which ones have permission to access the Internet, but it's highly unlikely that you'll recognize all the program names listed there - even the legitimate ones. And even if you check on a regular basis, if you find a rogue program there with Internet access, the damage may already have been done. It may have already sent out your passwords, credit card numbers, etc.
It's important to spread the word. People need to know that their systems aren't as secure as they think they are. And with enough publicity and pressure, maybe the companies writing firewall software will address the problem.

Chowhound
Comic Vine
GameFAQs
GameSpot
Giant Bomb
TechRepublic