I would've thought that all stations within the M25 should be in the zones.
The M25 and the boundaries of the Greater London Authority (TfL) are not the same - the GLA boundary is pretty much as established in 1965 when the old GLC was formed, and while the M25 existed in various plans at the time, it certainly hadn't started to be built then!
There are certainly bits of the M25 that are some distance outside Greater London; from memory I can't think of any bits of Greater London that go much outside the M25 but there may be some.
There are some stations outside Greater London (Epping springs to mind) that have managed to find their way into zone 6, for reasons I'm not sure of, then there's a few bits outside GLA area that are Oyster-able, e.g. 'zones 7-9' out to Watford / Amersham etc, and then Purfleet - Grays which doesn't seem to be given a zone number.
There are certainly a few extensions to Oyster which would be useful - Dartford is an obvious one (although London 'Freedom pass' is valid on trains to Dartford - and of course Oyster / Travelcard is valid on TfL buses all the way to Bluewater)
I am not sure whether co-operation to do Oyster outside GLA requires co-operation of the train company, local authority, or both.
If you really want confusing, it's worth bearing in mind that the -
City of London
1899 London County Council area (former Inner London Education Authority)
Area covered by London post codes
Area covered by London telephone dialling code
Greater London Authority Area
area inside the M25
pre-2000 Metropolitan Police area
Greater London Urban Area (used for some planning / statistical purposes)
are all different.
The area covered by London Electricity (Board) is probably subtly different as well...