GSM was designed at a time when consumer products, in particular the first GSM phones and the smart cards, were a lot less powerful than they are today (at that time, a desktop computer was using, at best, a 16 MHz 68020 CPU or something similar). Asymmetric crypto could not be achieved within a reasonable time frame on these cards.
The shared key model is a problem, but not really the one you may think about. The goals of the protocol are:
- To protect the confidentiality of the conversation against over-the-air listeners.
- To establish some "proof" that the call really occurred, for billing purposes.
The confidentiality was never meant for anything else than the radio transmission between the phone and the nearest base station. It is not, never has been, and never meant to be, an end-to-end (ie. phone-to-phone) encryption system. Providers want to access the raw data, if only to be able to (re)compress the voice feed more aggressively than what the phone themselves do(*). In that model, the provider is, by definition, trusted. A "shared secret" model, with a key known to both the phone and the provider, is fine in that respect.
Of course, there is ample room for making mistakes, for instance by using a poor key derivation function or an even worse encryption algorithm. The shared secret model, though, is not at cause here.
It is for the second point that using a shared secret is suboptimal. If the secret is known to both the user's device and the provider, then anything that is computed relatively to this secret could have been computed by either the user or the provider. As such, it should not be usable as proof in a dispute between the user and the provider. The billing mechanism is thus at risk (though experience shows that, in practice, providers don't find it hard to obtain money from consumers). An "academically" better model would involve asymmetric signatures (so not DH, but rather DSA) where a phone would sign its request for opening or maintaining a communication channel.
(*) Of course, accessing the raw data also helps interception by legal authorities, but to my knowledge that is not the primary reason. In fact, end-to-end encryption is hard because both ends must agree on the protocol to use. Point-to-point encryption is way easier.