There has been plenty research into mobile networks by people who have the resources to acquire the necessary test gear and documentation, aka nation states and intelligence services.

It's just that they have decided they would rather keep us all insecure than lose the ability to deploy their little spy toolkits on journalists and such.

Cool talk from Nohl where they deploy a location tracker over the air to the SIM card:

https://media.ccc.de/v/30C3_-_5449_-_en_-_saal_1_-_201312271...

If I remember correctly, that wasn't even a bug, but a feature mixed with insecure configuration.