How do you expect them to do that when the language doesn't allow it? Can you show an example of Go code which creates an invalid pointer?
// p points to address 1000
p := (*int)(unsafe.Pointer(uintptr(1000)))
Of course, this is why use of the unsafe package is heavily discouraged.
The important distinction is that a 'Nullable' value type need not involve a pointer, which means it can entirely live on the stack, which dramatically limits the damage that can be done by corruption: Worst case, corruption sets the 'hasValue' flag to true, and you read an uninitialized struct off the stack. Much less catastrophic than a double-free or pointer into random memory (Though, of course, a determined attacker could probably make do with either).