The zombies don't move particularly fast, so making them “at the same place enough” isn't particularly hard, using regular FPS networking.

They could even start the zombies on standard trajectories – you just need to send the trajectory and start time, and the zombie will follow the same path on all clients. Once a zombie is somehow disturbed from normal (killed, pushed, or whatnot,) you can start sending more information about that deviation.

Finally, if you have REALLY MANY objects, like a large-scale RTS, you will probably end up with something like the deterministic lockstep model. Everyone runs the same simulation, at the same time step size, and just share commands; nobody proceeds past the previous round until the inputs from all players for that round are known. Command latency is hidden with reaction/acknowledgement animations. Look up the “1500 archers” article for a good write-up!

That's one of many ways to do it, yes! I have no idea what they actually do – but if I were tasked to re-implement the function, that's what I would try first!