Pure speculation, but I would guess that the interfaces to baseband are not particularly hardened, so an attack on the phone from the baseband might be trivial.

Pure speculation, but I would guess that the interfaces to baseband are not particularly hardened, so an attack on the phone from the baseband might be trivial. Or worse, the baseband might have a trusted channel to launch arbitrary code.