It's been since 3G that I delved into baseband specs in any depth, but I would not trust a powered up phone not to be commanded to connect to a network.
https://9to5mac.com/2021/07/21/ios-15-here-are-the-devices-t...
If there is a secret involved in this it would be undocumented commands sent by the network to phones that then interpret them as commands to connect to the network, plus baseband processors the periodically look for such commands. They don't radiate, so very little power is used, but they should be entirely dormant.
If the baseband is still powered, I can only assume it is simply sending (or responding to) periodic commands that do not require network authorization, which could possibly still let the network know where you are even without involving any roaming charges.