By telling the radio firmware to do so?

edit: the sim can tell the radio to turn on, when it wants to send a message.

It is a full blown computer, with direct access to the radio firmware, with no OS oversight.

The radio firmware can be updated remotely, too, and the OS only knows the modem is on, because the firmware tells it so.

The icon on your phone showing signal/on/off is displayed by the OS, after querying the firmware. The OS has no way to know if the radio is on or not.

Yes but from where is this command originating? Can't be remote because well... the radio is off.

It can be remote but shifted in time. E.g. send a remote command that essentially says "if in airplane mode, every 60 minutes turn radio on and check for new commands".

That would cause major issues in areas where phones are forbidden for national security or sensitive equipment reasons from having antennas active. I've never heard a report that a manufacturer has even considered that idea as it could potentially cost them major damages.

Of course, that's not something that a legitimate manufacturer would have in their standard firmware.

However, that is a possibility for specific malicious firmware uploaded to some "phone of interest" to prevent its user from protecting themselves by turning on airplane mode.