It's possible, no matter where the object lives:

    #include <cstdio>
    using namespace std;
    class Type {
      public:
        Type(int a):_a(a){};
        int _a;
    };
    
    Type& getType(int a) {
      Type* t = NULL;
      t = new Type(a);
      return (*t);
    }
    Type& doSthWith(Type& t) {
      //no need (and no way) to check if t is reference to proper object
      t._a=t._a+1;
      return t;
    }
    
    int main() {
      Type& t = doSthWith(getType(5));
      printf("%d\n",t._a);
      return 0;
    };

This can be broken of course, for example by

    Type& getType(int a) {
      Type* t = NULL;
      return (*t);
    }

But that's another matter.

If we choose to write optional<User*>, then we have three possibilities. The point is that we don't have to do that in C++, we can write optional<User> and be certain that the returned value is either empty or a User.

Compare this with a function that returns a string:

    string get_name();

In C++, the caller of this function knows that a string is always returned. Null isn't part of the picture. The string object itself holds a pointer to some heap data, but that's not something the user has to deal with.

PS: I've done my fair share of programming in Haskell so I know the advantages it has :-)