How do you MITM someone specific that may be thousands of miles from you? Much easier when you have access to their modem. Exploiting system services - you can

How do you MITM someone specific that may be thousands of miles from you? Much easier when you have access to their modem. Exploiting system services - you can attack any kind of non encrypted traffic flowing through the modem. Such as unsecured applications running with broad permissions. Or you can inject data into kernel services that communicate directly with the modem. I don't know if on these phones the modem presents itself as a simple serial device, or if it has its own kernel driver (/dev/modem). If it does have its own kernel driver running in the phone, then this driver becomes an easy target for attack, granting full system access.