Plus backdoored cellular modems with over the air root
If you turn on airplane mode it disables the cellular modem, also if the modem is compromised it can't affect the OS because it's isolated via IOMMU. The only thing a compromised modem could do is ignore airplane mode commands.
If you're going to keep airplane mode on 100% of the time, why would you have a device with a cellular modem? If you're going to turn airplane mode off, your backdoor is open. It's just a thing we have to accept for now if we want to have phones. Someday we'll have better hardware.