I'm experiencing zombies in one of my survival worlds in peaceful mode. I have a screenshot to show that it's in peaceful, and you can see the zombie in the background.
I know it's not a graphical glitch, because I checked it was in peaceful, returned, still saw it present, and successfully attacked it with a sword. I got the screenshot after that.
I've only confirmed this bug on the latest stable release of the Java version. I don't know if it's present in the beta, so I'm not sure if it affects the drowned.