Detecting a second operating system within a baseband processor is extremely challenging, as it operates independently and is designed to handle communication tasks discreetly.
It doesn't need a second OS - just a few "accidental" vulnerabilities in the baseband itself (and keeping the source closed to make them harder to find). Free plausible deniability.
