Throwing AccessDeniedException without a route causes PHP errors

Problem/Motivation

Contrib modules might want to throw an AccessDeniedException to deny access to certain pages depending on certain conditions. This exception frequently takes place in situations where no route has been established (e.g. in a kernel event subscriber etc.). Right now, this leads to an error message "Call to a member function hasRequirement() on null" due to the following code in core/lib/Drupal/Core/EventSubscriber/CsrfExceptionSubscriber.php, on403 method:

 if (!$route->hasRequirement('_csrf_token') || empty($route->getOption('_csrf_confirm_form_route'))) {
      return;
    }

The solution is as simple as this little change:

 if (is_null($route) || !$route->hasRequirement('_csrf_token') || empty($route->getOption('_csrf_confirm_form_route'))) {
      return;
    }

See also: https://www.drupal.org/project/drupal/issues/3511584
Over at this issue, the "ban" module is affected, but the ban module is about to be moved out of core and this feature request is IMHO absolut valid independent of this module. That's why I'm filing a new issue here to make it independent of the ban module and to specifiy that it's not strictly speaking a bug in core, because there are probably no test cases in core after the ban module is removed.

Steps to reproduce

I'm attaching my test module here again. To reproduce install the module "crash403" attached and call an URL on your Drupal site that ends with "/crash". I'll see if I can create a normal test case.

Proposed resolution

See above. Just add "is_null($route) ||"

Remaining tasks

User interface changes

None

Introduced terminology

None

API changes

None

Data model changes

None

Release notes snippet

Don't know if necessary. If at all perhaps the fact that you can now throw AccessDeniedException everywhere. But that's IMHO the expectation anyway.