Doesn't this require the attacker to already "be on the other side of the airtight hatchway", in order to set up the exception handler?
Yes, but once malware is on the other side, it could be caught by the AV doing static analysis/signature match. This point of this technique is obfuscation and evasion.