If embedded ZK has TLS properties in the zookeeper.properties file, these will be used. If however, this file does not populate those properties, and NiFi does have TLS properties configured (nifi.security.keyStore, etc.), these values will be used to override the ZK plaintext connection listener to create a TLS connection listener.
If the zookeeper.properties file has an incomplete configuration (i.e. keystore password set but no keystore path), startup should fail with a clear error message indicating the missing properties and how to resolve.