By closing WiFi and mobile data, you shut down some attack paths. That means that your system is more secure, and probably immune to most script kiddies attacks. But the telephony part will still be active. It is certainly harder to exploit, but a smartphone is far from a 1960' telephone, and even the telephony part has interaction with the phone OS. That means that is is still possible that a combination of calls and SMS triggers an unexpected condition leading to a possible exploit. I know none of those, because even the [Stagefright bug](https://en.wikipedia.org/wiki/Stagefright_(bug)) cited by @SteffenUllrich in his answer uses a crafted *MMS*. And a MMS can only be delivered when mobile data (or possibly WiFi) is active, and will never be if only telephony is allowed.

If you can be sure that god himself was among the ingeneers that designed your phone system, you are absolutely safe. In any other case, bugs are always possible...

Of course, if you use other functions of your phones like displaying photos, viewing videos of playing MP3 (or any other music) files, you open new doors for attacks with every new application