Is it unpacked at all at any point. Is the user able to access it to be able to unpack it. If so is there any way to prevent that

It doesnt unpack the resourcepack, just saves the last used (that minecraft saves in the server resourcepacks folder) and keeps it loaded/loads it on startup.

But there is no way to prevent a resourcepack from being unpacked by the user, even if you use the "corrupted zip" trick, you can still open the zip file using a software like JD-GUI and extract all the assets from it.