Great find @Ivan Stepanov, I'm glad that we have a working soluion for MacOS!
Unfortunately after testing on 14 different TSAs (from StackOverflow and and Davide), the problem still persists on Windows and on MacOS with any other non-apple TSA. (see full testing details below)
My guesses are either:
A: There is some speical access for Apple-to-Apple timestampping that allows the Apple TSA to work on Macs, but all others are broken
or
B: Something is patched in ZXPSignCmd 4.1.2 to allow this, but since there was never a 4.1.2 version published for Windows, we're stuck with a bug on 4.1.1
All ZXPSignCmd Versions (latest Win: 4.1.1, latest Mac: 4.1.2)
It's great we have a solution for Mac, but lots of users, workflows, and build systems rely on Windows as well, so we need working solutions for both.
As @Softmatic GmbH and @Alex White have pointed out, it is possible to create a ZXP by omitting the TSA, however this comes with an expiration date, though "supposedly" far in the future, from the Adobe documentation in SigningTechNote.pdf sounds like it could break sooner without warning:
 
----------------------------------------------------------------------------------------------------------------------------------------------------
Full testing details on Mac and PCs:
Works on MacOS but not Windows
http://timestamp.apple.com/ts01
Both OS's report: Error - the timestamp returned from the chosen TSA could not be verified, so the ZXP created s likely to be rejected by other tools. Please recreate your ZXP with a different trusted TSA.
http://time.certum.pl/
http://zeitstempel.dfn.de
http://timestamp.globalsign.com
http://timestamp.globalsign.com/scripts/timstamp.dll
Both OS's report: Error: [cep] Command failed: ZXPSignCmd ...
http://timestamp.digicert.com/
http://timestamp.comodoca.com
http://timestamp.entrust.net/TSS/RFC3161sha2TS
http://tsa.swisssign.net
http://timestamp.acs.microsoft.com
http://timestamp.sectigo.com
Both OS's report: Error - cannot contact the chosen TSA. Please make sure the URL is valid and that you are onnected to the internet.
http://tsa.starfieldtech.com
http://sha256timestamp.ws.symantec.com/sha256/timestamp
http://timestamp.verisign.com/scripts/timstamp.dll
----------------------------------------------------------------------------------------------------------------------------------------------------
... View more