Sure. But to justify the three switches you must tell me more about this malware that would succeed with the baseband disabled in hardware while you continue to

Sure. But to justify the three switches you must tell me more about this malware that would succeed with the baseband disabled in hardware while you continue to have wifi enabled in hardware. I can only think of the special case where a carrier wants send a specially crafted message to exploit a flaw in FLOSS in order to implant malware that tricks the user about the status of the baseband. Still, if the carrier wanted to take that risk the only users who are protected are the ones who never switch on the baseband OS. I don't think it makes sense to decrease usability for the off chance that some user has an idiosyncratic threat high enough to never use the baseband os, yet low enough to toggle wifi on and off.