Your cellular phone modem is both remotely programmable and has full root memory access 24/7.
Let that sink in a bit.
Let that sink in a bit.
On Qualcomm chipsets in particular heavily utilize shared memory for baseband to application processor communication.
Meditek uses a similar architecture, and I sure as hell don't trust their MMU.
Outside of Apple, Librem and Pine are just about the only way you're getting a USB attached baseband.
edit - Here's a Mediatek Baseband->AP PoC even: https://comsecuris.com/blog/posts/path_of_least_resistance/
Even Apple's IOMMU has had vulnerabilities allowing for full memory access from the WiFi modem.
You start off trying to claim the entire class of vulnerability isn't possible because a few vendors made sane architectural decisions. When it's pointed out those sane vendors are in the minority, and there are real world examples of the terrible shared memory architecture being exploited, you scoff at the example being for a single device.
Nobody is claiming baseband == root, only that the terrible architecture prevalent in Android phones (the devices that make up the majority of the market) combined with the terrible software practices of SoC vendors results in a situation far more likely to be exploitable than shunting the baseband off on a non-dma capable bus.