[mindslight]

I feel like if this were happening 20 years ago, common wisdom would develop to buy from a list of model of cars where people had already blazed the path, directions of what the cell modem looks like and how to unplug it, prominent links to a community working on a libre replacement, and majority opinion of this is just what you should do to cope in the modern world. Now with the web community being so diffuse the majority opinion basically seems to be "whatevs". Perhaps if you dug into the right threads on the right manufacturer-specific forum you could find a thread or two with some investigation, but that's about it. It's also essentially impossible to navigate/compare the amenability of different makes to this.

FWIW I've got no actual experience, but given the general slowness with which the car industry moves I would guess the cell modem is just a module hanging off one of the CAN buses, receiving telemetry broadcast by other modules and injecting/interrogating commands when requested (like modern OBD2 ports). I suppose it could also be part of something like the gauge cluster that links different buses as well (at least on Hondas) but with the modular way cars seem to work I'd guess it's not likely.

I'd try to track down a copy of the factory service manual for your model. Those have seem to have gotten pretty thin these days too in favor of computer-based documentation, but it should at least help you work out how things are generally connected. (No point to the readily-available Haynes manual though. Those are apparently garbage)