I work on a project with a legacy service layer that returns null in many places if a requested record does not exist, or cannot be accessed due to the caller not being auth
I could be wrong, but it might be connected to the way EJB container handles exceptions. From Best practices in EJB exception handling:
To use the EJB container's internal housekeeping, you will have to have your checked exceptions thrown as unchecked exceptions.