in the similar vein, while making changes to create_account I was wondering why the form validation seems to be duplicated in both the php and in the javascript.

Yes, I'm pretty sure that's why it's duplicated. One of the things I like about Zencart is that it works in all browsers, regardless of the settings the visitor prefers.

Is it because we still supposed to be looking after people with javascript disabled?

Only if you want us as customers, I guess.