From a security perspective, you can achieve the same security either through a review of the component (which you want to achieve with an open-source baseband through the many-eyes-principle), or proper isolation.
Open source
The first appproach is very hard, as regulatory authorities need to certify your baseband firmware. Because of this certification requirement, even if you had an open-source baseband, it would need to be tivoized. You would perhaps see there is a backdoor, but you couldn't remove it.
Open sourcing generally does not imply anything over the security of the product. There are chilling effects from the easy possibility for a security review, which make backdoors harder to create. Of course, security patches can be provided by anyone and not just the vendor, which decreases the time between the discovery of a 0day and its fix. But that doesn't remove the need for a security review.
Isolation
Isolation removes the need for a security review of the isolated component, because the isolating component is reviewed instead. In that review, the isolated component may not be trusted at all. Google did this on the adobe pdf reader and flash player in chrome, and mozilla plans to do this on the adobe DRM plugin, to name two examples. In our case the baseband chip for example needs to be cut off the microphone line when its not having a call.
This approach is done by the Neo900 project. They state on their website:
On Neo900 one can be sure that the modem is actually turned off when requested, not just pretending to be. User will be notified in case of modem wanting to do something without his consent.
Isolation perhaps renders backdoors in the baseband chip useless, but when there is a 0day in the isolating component, it can be used to gain control over the phone.
If you want to be sure the phone is off when it tells you so, you should remove its battery. This can be inconvenient, but with that you can be sure, as the other smaller batteries in the phone are not capable of sustaining the phone for a long time. However, sending a few weak beacons "Hello, this is me!" may be possible, but that is pure speculation.
