You might be able to MITM some packets meant for the cellular network, but fundamentally you're not gonna be able to MITM any cellular packets without running y

You might be able to MITM some packets meant for the cellular network, but fundamentally you're not gonna be able to MITM any cellular packets without running your own base station (i.e. a device outside your phone). Whatever mechanism you used for redirecting cellular traffic to your MITM apparatus could always be bypassed by simply sending that traffic over the actual cellular network.