You are absolutely correct. When advertising an explicit null, the penultmate router will do a label swap rather than a label pop. It swaps the in label to a label value of 0 (explicit null) therefore preserving the exp bits value. This is indeed the only use I see for the explicit null label.
Note that with mpls vpn or l2vpn, you don't really need to use an explicit null since you have your service label that can be used for the purpose of carrying the mpls exp bits to the egress LSR.
Hope this helps,
Regards,
Harold Ritter, CCIE #4168 (EI, SP)