There is usually little or no security boundary between the AP and complex peripherals (like the baseband, cameras, GPU, audio subsystem, etc.) Usually these will have direct access to main memory (like having a DMA channel given to them), and will have firmware loaded into them by the AP at boot. After which, they can damage the integrity and privacy of your 100%-OSS AP software.

The baseband, particularly, is of concern because it's connected to the outside world, and is powerful and complex. And almost always closed, and provided by an American company (Qualcomm).

The firmware that runs the baseband processor manages communication via the radio (and sometimes wifi and bluetooth as well)[0]. Once loaded, that firmware will have plenty of opportunities to phone home or otherwise provide information about your location, activities, etc.

[0]: http://en.wikipedia.org/wiki/Baseband_processor

Why would anybody ever write code that isn't intended to be executed?

The camera executes its firmware, and it has direct access to the memory, flash, network, etc.

e.g. The camera firmware blob could be tagging all your pictures with some kind of hidden watermark. Who knows ?

EDIT: Just to clarify, firmware blobs are not executed "on their own", they are normally executed on a micro-controller that is embedded in the baseband / power management / gpu / any other chip.

FYI the cameras in most phones (at least the ones I've played around with) contain no firmware. It's just a relatively dumb image sensor connected via a MIPI interface to the main SoC, and is under control of it. It cannot access memory on its own.