Curve25519 extension field
I don't really know so I'll tell you my best guess: One of the design goals was &quot;free point validation&quot;. To do this, we want to make sure that no matter what $x$-value in $F_p$ we're sent, it is a valid point on the curve.
If $x\in F_p$, then to make an elliptic curve point we need $y$ such that $y^2=x^3+488862x^2+x$. But we have no reason to expect that $x^3+488862x^2+x$ will be a quadratic residue, so in general we will need to define $y$ over $F_{p^2}$. Thus, if I send you any value $x$ in $F_p$ and tell you it's a point on the curve, you know that there is some $y\in F_{p^2}$ such that $(x,y)\in E(F_{p^2})$, but you have no guarantee that $y\in F_p$.
The key exchange uses $x$-only arithmetic, so the key exchange will never need to use the extension field in any computations. Theorem 2.1 tells us that all multiples of a point with an $x$-value in $F_p$ will also have $x$-values in $F_p$, which proves correctness of the $x$-only arithmetic, more or less. So I think the case of $Q\in E(F_{p^2})$ but $Q\notin E(F_p)$ is used, but only via an implicitly-defined $y$-value.