Yes, a zero-beta asset can still have its own idiosyncratic risk. And, yes, it is perfectly kosher for a zerobeta asset to offer the same expected rate of return as the risk-free asset. The reason is that investors hold gazillions of assets, so the idiosyncratic risk of the zero-beta asset will just diversify away.