One thing that ZoneAlarm and most other software firewalls (WindowsXP's built in firewall is one exception) do that most routers don't is control the outgoing connection from your computer. If you get a virus or trojan that your anitvirus software doesn't know about it could connect to the internet and the hardware router would happily let it. ZoneAlarm could easily stop these malicious programs from getting out, either because the virus wants to infect other computers, or because it's trying to call home to download more software onto your computer. If you want to read a little more, you go
here and go to the Shields Up! section.
goates