[Springcleaning]

This one will buffer (to a certain extent) and only flush when cellular is on and cellular traffic is already occurring. When cellular is on but cellular data is disabled there is still cellular data traffic at OS level, I expect more advanced spyware will travel with that data-stream. Also that indicator and a switch is just software, if you have full control over the OS, you can change that.

[red0point]

When cellular data is disabled (assuming it really is, not just faked to the user), then the corresponding radio bearers for user plane data habe not been established, thus no data-stream can travel with it. You can only communicate with the eNb and MME in this stage, and even this isn’t exposed directly to the OS but embedded in the Chipset.

[speakspokespok]

My assumption has always been that a clean phone in airplane mode but with WiFi enabled would not use the cellular radios at all. In that mode would a cell tower still be in communication with the phone at some level?

[red0point]

Not directly, as the flight mode really prevents any radio communication (it takes a bit to shut down as it sends a NAS Detach Request first and waits for a reply for a few seconds).

However, there is also WiFi Calling - in that sense, your phone establishes some connection with the cell network. However, I don‘t think any user data may travel on this bearer, but there might be some edge case where this is possible.

[tsjq]

That is super-sneaky