Can you even run AT commands without already having privileged access on the phone?

I'm honestly not sure (I haven't played with modems much), but I do know that doing a clean wipe of the eMMC or an SD card is way easier than a clean wipe of your modem. It's also a fair bit harder to check for anomalous activity, although with easier shell access, maybe that mitigates both problems?

To be clear, I think it's a lose/lose situation, because I want access to the modem in my pinephone, but I'd rather shell access require some kind of physical attestation (serial connection over the pogopins or something), instead of ... this.

I believe the Bluetooth Serial Port Profile supports AT commands, and I've seen phones connect to bluetooth devices while locked... so...

...so nothing of substance is hiding there, because AT commands from Bluetooth peripherals have no way to reach the modem (they just happen to speak same-ish language the modem does).