> I'm trying to determine if this is actually a defect in the language,
> or am I missing something?:

The problem is that any operator-> returns a pointer, not a reference,
and so the information about whether you're applying "->" to an lvalue
or rvalue is lost. [expr.ref] simply states:

> The expression E1->E2 is converted to the equivalent form (*(E1)).E2

I guess it's not entirely unfixable though. We could say that the
result of dereferencing the pointer is converted to an xvalue if E1 is
an rvalue. Perhaps this wouldn't even break too much code, considering
that barely anyone uses rvalue qualifications on functions.