The OS absolutely controls functionality of the baseband, it would be a legal nightmare if it just didn't actually respect proper radio settings. But from a design perspective, it doesn't actually matter that much at all I feel. Any practical and secure design for a cellular phone has to assume the network is totally compromised and hostile, and so it can never be in the trusted base. From this perspective, adding the radio chip and its software to that category is not actually a huge leap. Even today vendors who own all the IP on a bus will still insert IOMMUs, etc inbetween components. It isn't dissimilar to game consoles; they assume that anything outside their die is compromised and hostile, and if you start from that premise, you can still make it very secure even when your threat model includes hostile components on the PCB.

Radio firmware is probably somewhat broken in practice (what isn't these days) but ultimately the openness stuff is a red herring IMO as far as security is concerned, you either assume it's compromised or not.