There have been plenty of real environments where NULL pointed to valid memory (AIX, for example)

It also has a reasonable use case ( or did, pre Spectre).

It allows you to hoist and speculate loads that may be null. Since it is valid memory, instead of a fault, you would just get a result (usually zero on most of these platforms) you would throw away if it was not needed.