Okay, I have a hypothesis (not yet confirmed) that one of the zytor.com secondaries -- specifically the anycast cloud ns-global.kjsl.com -- might have thought it was supposed to be a secondary for acme.zytor.com. As it is a legitimate secondary for zytor.com which also has ns1.zytor.com as master, it was permitted to AXFR the zone. It then returned the TXT record to go with the CNAME as a "courtesy".
Apparently, though, this only happened to some members of that cloud, so I could not see it from my horizon.
Going to try to verify that hypothesis now...