Its a good question, and one that seem to be unspoken. I'm guessing, the charitable version could be that the implementation on a major processor vendor works

Its a good question, and one that seem to be unspoken. I'm guessing, the charitable version could be that the implementation on a major processor vendor works out to be just the right amount of security because the page fault handler wasn't optimized as heavily as the syscall interface. So, this might provide better security on a "slower" path, which turns out to actually be faster once the faster path is fully secured?