As with all lvalue context operations, the rational is that it must exist so you can assign to it (e.g. $$a = 123;)

Except not quite. Cause the element is evaluated in lvalue context in both for (@a) and f(@a) as well. So why don't they replace the NULL with a scalar?

That's cause they create and return a proxy scalar containing a reference to the array and the index. Using magic, accesses to this scalar access the original array element.

$ perl -MDevel::Peek -e'sub { Dump($_[0]) }->( $a[0] )'
SV = PVLV(0x558b3a14b8a0) at 0x558b3a0f4538
  REFCNT = 1
  FLAGS = (GMG,SMG)                       <- Get and set magic
  IV = 0
  NV = 0
  PV = 0
  MAGIC = 0x558b3a119460
    MG_VIRTUAL = &PL_vtbl_defelem
    MG_TYPE = PERL_MAGIC_defelem(y)
  TYPE = y
  TARGOFF = 0                             <- index
  TARGLEN = 1
  TARG = 0x558b3a1241d8                   <- array
  FLAGS = 0
  SV = PVAV(0x558b3a0f6868) at 0x558b3a1241d8
    REFCNT = 2
    FLAGS = ()
    ARRAY = 0x0
    FILL = -1
    MAX = -1
    FLAGS = (REAL)
[download]

Creating this proxy for \ would cause issues.