You don't want to get caught transmitting on cellular bands.

You can do this with just receive though. A $10 USB TV Tuner and a Raspberry Pi will listen in to most cellular bands, and pull enough out of the over-the-air machine to machine chatter to do a similarly accurate job of counting cellphones...

The cellular transmitters (can)_ run with a lot more power than Wi-Fi, and are on lower frequencies, so the range at which you'll detect them is significantly longer, which might make localised device counting less useable.

RTL-SDR won't get you most LTE bands, 1800, 2100, 2600 MHz will be quite challenging.

If you buy carefully you can usually get 1800 on a TV Tuner with the right chipset. You can get to 2.4GHz with a satellite downconverter if you haven't by then bought in enough to buy a (way) more expensive SDR.

E400 goes to around 1.7 GHz, R820T to about 1.85 GHz, which doesn't cover the full LTE band, so yes it's pretty shit at the higher frequencies, 10$ won't get you anywhere there.

But then you are not in the price range anymore.

Yes but rogue femto cells for this purpose have been ruled illegal in France and, I believe, all EU countries.

Retailers rollbacked to IR sensors and now are slowly adopting counters on cameras with deep learning for disambiguation.