Welcome to the forums
Don't quote me on this

but yes I believe that the messages will not be scanned for AV/AS. The reason why is that Amavis is hooked into the Postfix SMTP instance, and externally fetched email will not be injected into the system that way. Imagine you are collecting a remote POP3 mailbox from gmail.com, how would you tell your ZCS MTA to accept mail for gmail.com
You could look at using fetchmail to inject these messages through your MTA, but I am off the thinking that if you are collecting from a remote account it should have already been scanned.
Hope that helps.