A phone with its SIM out is still registering with the network.

... and has an IMEI identifier.

Yes, and that's usually directly traceable to who the phone was first sold to.

Or to the subscriber who last registered it to a network with a SIM, even though the SIM is not there now.

Typically that history is kept and it is kept for up to 20 years depending on which telco you look at. Those and the CDRs are gold for data mining and there are companies that specialize in doing just that.

It's insane if you think about it but the phone company knows as much or more about you than your mother or your spouse.

I wouldn't assume pulling a SIM is enough to hide the phone's location. The modem will still be powered, the IMEI isn't part of the SIM card and is a unique identifier. Plus last I checked you can still contact 911 without being a subscriber.

I'm no expert on cell networks but my impression is the baseband will still ping towers and participate in the cell network on some level. If the phone gets confiscated or its IMEI otherwise associated with you, it can probably be abused to try place you in an area at a given time even without the SIM card.

Just use cameras without any RF hardware. (they tend to have better optics / zoom capabilities anyways)