This test was a "real world" test, which is quite different from a malware hub test.
A "real world" test tries to simulate as best as possible the typical situation surrounding a malware attack.
For instance, in the "real world", zero-days are usually delivered by email or by malicious link. They don't come in zipped packages that strip them of the "mark of the web".
That's one reason why AVs perform much better in such tests than they do in malware hub. Just because an AV fails miserably in the malware hub doesn't mean that it will fail miserably in the real world.