The first thing I do on new Quectel firmware is the check with Ghidra. I don't use the insecure Linux modems, just the baremetal modems. Which are actually 2 CPU's with 2 firmwares. The modem itself is either a Broadcom or Qualcomm RF chip with all those AT commands and its completely insecure AT parsing via internal UART. The main CPU is best used baremetal, which is much more secure and needs much less energy than the Linux variants. I fixed dozens of security issues in their SDK, but still prefer it over STM, Atmel or Raspi.