General design failures/bugs from assumed acting-in-good-faith silicon/sw designers vs not-acting-in-good-faith silicon/sw designers.
Assuming the radio's are the primary threat to privacy then I'd prefer a design from a privacy activist company who explicityly designs the hw so that the less trustable parts are forced behind physcial and defined interface "firewalls".
> Complex parts like the cellular modem or the WiFi can access the very same RAM that is used at runtime to store your most private data, but at the same time they are controlled by binary-only firmware that no one except the manufacturer of that chip has access to.
For the cellular modem, in your run-of-the-mill iPhone or Android phone nowadays, it is simply false that the cellular modem can access arbitrary data in RAM. Can't tell you about WiFi, but I expect a similar situation.
There's a lot of room for improvement in secure smartphone architectures, but the "baseband can read your photos" trope is simply false.
Modern Android/Qualcomm phones have pretty sophisticated security architectures that do indeed isolate the baseband, partly because exploiting baseband bugs was such a common source of phone unlocks in the past. If an app is using SSL then the baseband can't read what's happening.
If the chips are tightly integrated propriatary black boxes like on most hw then from my POV its _physcially_ possible for them to read anything regardless of what the designers/industry say because I do not trust them.
You trust your sources that say "..simply false that the cellular modem can access arbitrary data in RAM". I don't. Even if you claim to have personally designed, fabbed and shipped that silicon I still have no practical reason to trust.