OK, I admit: for WiFi it is not called "baseband", but something like "WiFi chip", but the functionality is the same (just for WiFi instead of, say, UMTS or LTE) - it also runs a hidden, probably bugged, firmware.
Are there consumer ARM mobile devices with an IOMMU?
Unluckily I can't give any recommendations, since I myself still have to read up a lot on the whole topic. :-(
"Even isolated basebands often have a USB bridge (which can be exploited by pretending to be another type of device with a vulnerable USB driver) and direct access to the microphone ... iirc it's using a high-speed serial link, not USB. The microphone is connected to the audio codec, which is connected to the application processor. Uplink audio is sent from there to the baseband."