> Your phone’s baseband talks to towers before the OS ever sees anything.
That's absolutely not true for any of the devices supported by GrapheneOS. The cellular radio is an unprivileged, isolated component which is set up by the OS at boot and doesn't transmit/receive anything until the OS activates it. Airplane mode properly disables cellular radio transmit/receive including in early boot.
> But it cannot rewrite telecom protocols or control what the carrier forces the modem to do.
The cellular model in the supported devices is not controlled by the cellular network or carriers. It's configured by the OS including choosing which protocols and features are active or whether it's active at all. Airplane mode works correctly, as does configuring the preferred network mode.
> stops Silent SMS
SMS without content to display are not a privacy issue.
> Carrier / Network Layer = king
No, that's not how mainstream smartphones work at all.
> Modem obeys towers whether you trust Google or not
No, it doesn't obey the cellular network or carriers. It's Samsung that's being trusted, not the cellular network or carriers. It's an unprivileged, isolated radio similar to Wi-Fi, Bluetooth, NFC and UWB. It doesn't give control to the networks it joins just as those other radios don't do that. There can be firmware vulnerabilities so there's a lot of internal hardening and regular updates. We can harden it through attack surface reduction (disabling protocols and features) and we can harden the OS from being exploited from it since it's an isolated component like the other radios. An attacker exploiting the cellular radio does not get control over the device and needs an OS exploit for the drivers/services talking to the cellular radio to take control of the OS, which is certainly something we can and do protect against.