This is what media shows you, but reality is much simpler than this. They are just making you look at the wrong angles. The truth is, regulatory bodies demand that you should have closed source firmware for cellular radio modems. In the best cases, like for example, an amateur radio project, the radio is supposed to be "Tivoized", meaning while one can see the firmware used, they won't be able to modify or patch it, even to fix any visible vulnerabilities.

By having such vulnerabilities, with simple technologies, one can easily hack the devices of users. Secondly, such radios are often not isolated from the CPU, in which case, even if one flashes an entirely open source operating system, with even ignoring the radio part, the radio will function it's own because it has direct access to the CPU, and we cannot turn it off. This makes it the textbook definition of a tracking device.