My guess is that there's an x86-ISA JIT or emulator or threaded-code VM, that itself reuses these flag bits (when it can guarantee a stretch of non-ALU code) to

My guess is that there's an x86-ISA JIT or emulator or threaded-code VM, that itself reuses these flag bits (when it can guarantee a stretch of non-ALU code) to smuggle information between HLL ops. So Apple is in effect transparently transporting the smuggled data.