So, at my work, we host both SFTP and FTP to receive data feeds.

Has anyone seen an FTP honeypot that would serve zip bombs to malicious users and allow legit users proper access?

Cowrie [0] provides an SFTP and Telnet honeypot and you can configure the filesystem to serve your desired files. Not quite a passthrough for legitimate use, unfortunately

[0]: https://github.com/cowrie/cowrie