You could already do that on this particular modem; the author's previous post (linked from the first paragraph here) involves running a lot of arbitrary code on the modem, and there's an entire alternative implementation running around (https://news.ycombinator.com/item?id=30301837 discusses it a bit). This just talks about running arbitrary commands specifically through the AT interface on the stock firmware.

You and everyone else can own your modem. I'd rather someone not be able to install an undetectable rootkit on my phone with nothing more than an AT command...

Can you even run AT commands without already having privileged access on the phone?

I'm honestly not sure (I haven't played with modems much), but I do know that doing a clean wipe of the eMMC or an SD card is way easier than a clean wipe of your modem. It's also a fair bit harder to check for anomalous activity, although with easier shell access, maybe that mitigates both problems?

To be clear, I think it's a lose/lose situation, because I want access to the modem in my pinephone, but I'd rather shell access require some kind of physical attestation (serial connection over the pogopins or something), instead of ... this.

I believe the Bluetooth Serial Port Profile supports AT commands, and I've seen phones connect to bluetooth devices while locked... so...

...so nothing of substance is hiding there, because AT commands from Bluetooth peripherals have no way to reach the modem (they just happen to speak same-ish language the modem does).