Right, the null pointer gets dereferenced in the kernel, but (assuming I'm understanding the report right) the means of exploitation is to create a userspace memory mapping with something mapped at address zero, and cause the kernel to read from that address / run code at that address instead of faulting when it tries to dereference NULL. The PoC code is userspace and does this:

         //map NULL page
         vm_deallocate(mach_task_self(), 0x0, 0x1000);
         addr = 0;
         vm_allocate(mach_task_self(), &addr, 0x1000, 0);
         char* np = 0;
         for (int i = 0; i < 0x1000; i++){
           np[i] = 'A';
         }

Am I misinterpreting this?

Re SheepShaver and Basilisk II, those are non-Mac apps, and at least on Linux, there's no requirement for an emulator (like qemu) to map address zero in the host to offer a usable zero page in the guest; it's a convenience depending on how you write the emulator, but it's by no means needed. I don't think this is true of other host platforms either, but I'm less familiar with those.