It's a shame that with a freebie such as ZA you cannot specify your own rules by port number and/or direction - simply the option to open up the less well know ports over 1394.
Not used the UltraVNC product but other similar products for the same purpose. Was always able to tie them in on a specific port number when I used a purchased software firewall - I used Black Ice for several years.
Still very happy with ZA despite the lack of that ability.
Good advice from Keef re. the two-step process, passwords, and the restriction of not allowing the router to accept external VPN connections.
At the end of the day if your PC is up to date and you have both a router/hardware firewall and the PC software firewalled, you are keeping your exposure as minimal as practically possible.
As Keef also states, keep a check on your router log so you can have that added 'comfort factor' that no-one/nothing is getting in that is out of the ordinary.