Can the runtime be upgraded?

Yes, if apps Foo and Bar use (for example) the freedesktop.org Platform 21.08 runtime, then upgrading the fdo Platform 21.08 runtime is usually enough to give both Foo and Bar a fixed copy of zlib.

Similarly, if Foo uses the GNOME runtime and Bar uses the KDE runtime, and both the GNOME and KDE runtimes are based on fdo Platform 21.08, then having the maintainers of the GNOME and KDE runtimes trigger an automatic rebuild against fdo Platform 21.08 is usually enough to give both Foo and Bar a fixed zlib.

The only time this would not be enough is if Foo and Bar are statically linked to zlib, or build and bundle their own zlib in /app/lib, or otherwise have their own private copy of zlib instead of using the runtime's. Traditional distro packages have the same limitation, of course.