The backslash case cost us the most, and the part worth warning people about is that the usual ways of checking it all lie.
We had packages we suspected were written with backslash separators. Python's zipfile and .NET's ZipArchive both reported them clean, and those two normalise in opposite directions, so the fact that they agreed meant nothing at all. Only scanning the raw central directory bytes settled it, and the answer was yes, the archives really were backslashed.
So reading filename bytes before library normalisation isn't a small detail, it's the only thing that answers the question. Any checker built on a zip library inherits that library's opinion about separators and will quietly certify the exact thing it exists to catch.
Case sensitivity was second for us, and it only ever showed up after upload, because the local filesystem didn't care.