Possibly the idea is to prevent malware already on the phone from logging location data while the radios are dark, and then uploading the historical location data when the phone reconnects?

That said, it's obviously a very limited form of protection. I guess it speaks to the sad state of mobile security that this is the best Snowden and Bunnie can come up with - the only sane choice for a potential target is to assume the mobile device is untrusted and try to reduce the scope for it to snitch on the user.

When the GPS antenna is on, it gives off RF interference? Just a guess. GPS draws quite a bit of power when turned on.

Probably not from the antenna, but the downconversion and signal processing chain definitely will. They are shielded, but I'm sure some gets through.

In the the linked article, it states they intend to attach signal probes to test points on the iPhone mainboard to read when certain interfaces are active.

The article mentions the answer to that.

I assume similar to the way radar detector-detectors work. Superheterodyne receivers mix incoming RF with an internal signal to make a much lower intermediate signal they can tune to. The device will leak some of the internal signal and you can detect it.

Now I wonder what the challenges would be to build a radar detector-detector-detector....