I think that you are on the right track. I believe that they are there to (hopefully) deflect rocks that might have rolled down to trackside in a cut, and are laying in wait to knock off a cylinder cock.
The cylinder cocks are made of bronze and always come out 2nd when they come up against a rock. Then you run the rest of the trip with steam blowing straight down into the ballast, blowing rocks and dirt up into the bearings and, in general, ruining the engine crew's day. There is also the stub of the cylinder cock still screwed up into the cylinder, which is a pain in the butt to get out.