None of their modem code is open source. It's baked into a proprietary modem image that runs on a different subsystem then the application processor.

You could run a your own OS on the application processor, but millions of lines of code that are actually doing the "phone" part of the device is going to remain closed.

I doubt you could run your own trust zone image either, so you are effectively running an open source guest OS where all the interesting stuff is controlled by propriatery code.