It's not emulating the FP code itself that used this technique. The issue is that the emulated FP code can include FP branch instructions, and those FP branch

It's not emulating the FP code itself that used this technique. The issue is that the emulated FP code can include FP branch instructions, and those FP branch instructions have branch delay slots, and the instruction in the branch delay slot can be an ordinary integer instruction like a load or store - that has to be done with user permissions - and it can even be an instruction from some weird extension to the ISA that the kernel might not have heard of. It's executing those branch delay slot instructions, in the branch-taken case, that uses this W|X page.