Following the discussion on illegal cell tracking where several comments mentioned the firmware can be a problem, here's a link to a free-software firmware.

I believe this is important, because on Android the firmware controls the network connection (and GPS, etc). It has its own embedded Linux, flash and CPU so even if you have root and run a firewall on android, it can send packets that will not be visible to the android kernel.

Most firmware have adb and fastboot, which can be used to replace what's running there by something you can recompile and audit. If you don't like it, you can also restore the initial firmware, for ex: https://github.com/Biktorgj/quectel_eg25_recovery

EDIT: replaced baseband by firmware. I confused one for the other. For context as to why it matters, see https://news.ycombinator.com/item?id=36658078