I think it is easier to understand the results when the values that we don't know are set to empty/null rather than explicitly set to zero. I think that explicitly setting to zero might be a leftover from the time when osquery couldn't handle empty column values.