Execute permission can be reasoned as a special program access control mechanism. The search permission on the other hand is described like this in the POSIX specification for an error code for open
[EACCES] Search permission is denied on a component of the path prefix, or ...
and for fchdir
[EACCES] Search permission is denied for the directory referenced by fildes.
Why is search permission mandatory for `cd'ing or traversing down a directory? What security rationale was there? Why does it has to be separate from read permission?