My initial analysis was incorrect after talking with the bash(1) folks. test(1) is doing things wrong too:

        case FILEX:
                /* XXX work around eaccess(2) false positives for superuser */
                if (eaccess(nm, X_OK) != 0)
                        return 0;
                if (S_ISDIR(s.st_mode) || geteuid() != 0)
                        return 1;
                return (s.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) != 0;

So it looks like test(1) is broken as well (doesn't check for ACLs, or MAC info).

Interesting why it's only implemented for X_OK though...