>The latter should provide complete protection from IMSI/IMEI sniffing by rogue base stations.

Only on SA and even there it is optional: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.36A.pdf