In modern phones, doesn't the main chip control the baseband chip rather than the other way? What is the threat model?

Obviously since phone calls and text messages are unencrypted the baseband chip could send them elsewhere. But your internet communication should already be encrypted before it hits the baseband chip. So is the threat model Motorola has intentionally introduced a backdoor to leak data from the main chip to the baseband chip?

"control" is mostly a gentlemans agreement. It sends commands. The OS running in the baseband can decide how to handle the commands. Assuming a malicious vendor, motivated by its host nation, that would be where they could place the most effective backdoors.