A page fault is used as a way of executing the trampoline without the page having to be made executable/writable---the page fault handler recognises the page as a special trampoline page and handles the jump to the trampolines target address (which was previously registered using the new syscall).

Note that AFAICS this is unrelated to Spectre. The intended use is for constructing closures for use in FFI libraries such as libffi.

EDIT: I think I perhaps misunderstood your query---are you saying why not just make a system call where the kernel creates the page for you with the desired trampoline code and execute permissions?

edit: also, “spectre mitigations” was just a shot in the dark. It does feel like this mode of jmping (modifying saved registers and restoring them) would be more prone to interfering with speculative execution.

I'm guessing, the charitable version could be that the implementation on a major processor vendor works out to be just the right amount of security because the page fault handler wasn't optimized as heavily as the syscall interface. So, this might provide better security on a "slower" path, which turns out to actually be faster once the faster path is fully secured?