This is correct of course, but the reason things end up "mostly" zero is simply because most memory is zero. The OS itself clears memory pages to zero when they are committed into a process's address space. It's not the program that does it, it's the OS itself.
(If the OS didn't do that, then a program could get data from other extinct processes by just malloc'ing a big block of memory and looking at it -- that's obviously an unacceptable security problem)