It works now! It was indeed a ZoneAlarm problem. What I tried before was going to ZA's firewall tab and click on "xxx programs secured". Then I removed all references to Thunderbird, expecting that ZA would ask me for permission the first time Thunderbird was started after that. But it did not.

When I clicked on Firewall -> Settings and set the firewall slider to off, Thunderbird could suddenly connect, so it was indeed a ZA problem.

Then I went again to Firewall -> "xxx programs secured" and then there is an 'Add' tab. Selecting that lets you browse to the Thunderbird directory and choose Thunderbird.exe. That solved the problem!

I did not know you could add applications manually that way in ZA. Stupid me. I thought ZA would handle anything not in the list, so I thought removing it from the list would be sufficient.

Sorry I did not understand this earlier. Many thanks for your patience!

Just an anecdote.

Some 15 years ago, I was still using Windows 98 at the time I installed Zone Alarm firewall to test if it would do what I needed to do. After the 30 days the evaluation period expired and my connectivity to the internet was lost entirely. At the time Zone alarm simply turned itself off but did not put setting back to how they were before it was installed. So ended my only interaction with zone alarm. I was not impressed, regardless of how good it was as a firewall.

My guess is it still does something just as brain dead in windows safe mode, so when it screws up using safe mode does no reveal anything because zone alarm has left broken internet connectivity in it's wake.

Or maybe some ports are closed (by Windows), but you need a firewall to open them?

Good to see it works. :) Could you mark one of the answers as solution? This could even be you own if you want.