Cellular modems are typically locked down completely to shit. But I know of a few LTE chips that can be obtained with no pre-burned vendor boot keys, and also have the vendor modem sources and toolchains leaked.