Learned a few things I didn't know about exception handling, like Vectored Exception Handling. If it's possible to somehow have enough permissions to install a generic vectored exception handler that has enough complexity to emulate generic instructions, not sure why the shellcode couldn't just be included there instead.

Maybe someone else will have a follow on regarding some product that does some more complicated processing in a VEH that could be used to implement something that has the same shape as this.