The LegacyProjectChecker is registered and called as an early startup extension. It then accesses the plugins default object, which is itself created when the bundle gets started (the usual mechanism). Although the bundle is defined as automatically being activated when one of its classes is accessed, the package of the LegacyProjectChecker is explicitly excluded from this rule. Therefore it looks like the ProjectLegacyChecker could be executed without the bundle being started before, and the NPE happens.
Assigning to Andrew, he might know more about why that package is explicitly excluded from the bundle activation policy.