You don't even need a traditional app backdoor to do this. The carrier can just send the message to the baseband radio itself, which has a direct connection to your GPS receiver, among other things (usually) like the camera and microphone. That means these peripherals are accessible (in theory, Snowden says it has been done in the past) even if the main app OS is shut down.