Dropping an extension’s .jar into bundles folder is probably still supported (you could verify by trying it then loading the Bundle (jar) Info page in Lucee admin), but I’d expect it to be inadvisable, not only because only .lex files are available for download, but also because the extension’s .lex file contains multiple .jar files plus esapi-function.fld which defines the functions available to Lucee.
More than important than the installation method for me was the fact that not only did the new OWASP/ESAPI/Guard extension break my automated tests, but most significantly does not appear to support allowing certain commonly used and critical HTML tags such as <img> via HtmlPolicyBuilder.
I know that 2.6.0.1 requires libs with CVEs, but I don’t have time to deal with the multiple breaking changes, so for now I’m not updating the extension beyond that last v2 nor refactoring major portions of my own Lucee udf library and dependent apps.