Hmm that's a good point, I had not considered the shared memory architecture of the Qualcomm chipsets.
That said, given that using AT commands usually require enormous amounts of (potentially insecure) string parsing I wouldn't be surprised if there are vulnerabilities to closed source blobs even over USB. That is to say, the reverse engineering on the Android side could improve the security posture (or it could also make it worse!).
Not really. The USB modem was chosen as it provides isolation from the closed-source blobs that run on the modem. This way, the modem doesn't have access to the main memory. Pine Store Ltd (the commercial entity) being based in china, they certainly could have sourced a SoC integrating a 4G modem, but there's already a zillion devices like that, the idea was to build something compatible with FLOSS from the ground up.