This isn't just about software capabilities. The telcos don't need to have remote code execution on the device. Their huge network of receivers has to identify your device for routing, and that reveals your location. Simply connecting to the towers implies that you're within a few miles of them. In areas with denser coverage, triangulating you within a few meters is trivial, and I suspect that every network is storing your location in perpetuity from this method alone. It isn't a issue of software freedom, it's an issue of having a radio signal emitting from your pocket to a huge network of receivers with known positions.

Only way to guarantee you aren't being tracked is to turn the signal off, which isn't feasible for most.