Nearly all mobile phones are vulnerable to IMSI catcher attack's fake mobile networks. They can access storage, inject rootkits/backdoors, turn the microphone on view internet traffic even with a VPN in use. Conduct MITM attacks.
They all have bad modem isolation, allow IMSI catcher direct access to hardware components that allow for compromise. Some phones have good modem isolation there all old phones.
This explains it: https://replicant.us/freedom-privacy-security-issues.php
Just to be clear the phones with good modem isolation prevent remote attacks on phones IMSI catchers can do. Or there wouldn't be a threat model for it. So the phones on that site prevent it.
I want to no about 4G portable hotspots separate from phones, since there seems some doubt about IMSI catchers. Here's an article from electronic frontier foundation about them, why phones in general have bad security.
I'm considering if buying a portable 4G portable hotspot would be safe from IMSI catcher if a phone with no sim cards at all was connected to the portable 4G hotspot.
What effects could a IMSI catcher have? I'm thinking as its separate from the phone itself it obviously stops access to phones hardware components. But what hardware it can see and access on the portable 4G hotspot itself is a question? it might be able to backdoor, compromise it's security.
I don't know if there are any 4G portable hotspots that have good modem isolation. The article explains if you use a VPN on a phone with bad modem isolation, then an IMSI catcher can see the all traffic unencrypted.
So if using a VPN on a phone with no sim cards at all that's connected to a portable 4G hotspot, will the IMSI catcher get unencrypted access to all traffic? or is good modem isolation needed for the portable 4G hotspot itself, to prevent that as it is on a phone?
Maybe this would be the same for home wireless mobile broadband? They plug into power source but are also 4G but closer to a traditional router.