[bri3d]

There are a lot of open-source SDR projects around for things like LTE - you'll never get the per-unit costs of fixed function taped-out designs but it should be doable. SDR stacks already exist for WiFi monitoring and analysis although most of the stacks are CPU based and therefore too slow to associate with networks because they can't send ACKs in time. With an FPGA based system the latency requirements are probably achievable.

The better approach is probably a fully open firmware for an existing ASIC - let someone else subsidize your production costs. Obviously there's still attack surface in the fixed-function ASIC components but the attack surface is way smaller and the boundary could probably be audited fairly well.