The risk only arises if the component of a system that accepts and validates user input does not use (or account for) null-terminated strings. That validator will see a different string than the syscall will; this is called null-character injection, and while it is difficult to craft effectively, it can lead to accessing resources that you thought you had protected by validating the string.
You are quite correct that nulls are not legal characters in POSIX filenames; however, that is irrelevant. The nulls are only an issue in the processing; once they reach a syscall, the first one is treated as a terminator.
The risk only arises if the component of a system that accepts and validates user input does not use (or account for) null-terminated strings. That validator will see a different string than the syscall will; this is called null-character injection, and while it is difficult to craft effectively, it can lead to accessing resources that you thought you had protected by validating the string.
You are quite correct that nulls are not legal characters in POSIX filenames; however, that is irrelevant. The nulls are only an issue in the processing; once they reach a syscall, the first one is treated as a terminator.