The OS absolutely controls functionality of the baseband. But it doesn't actually matter that much at all. Even if the baseband were fully open any serious, truly secure device is still going to use IOMMUs, etc to segregate the systems from each other and compartmentalize them. This is already true today, you can find tons of vendors who own all the IP in multiple subsystems on a bus, and they will still insert IOMMUs inbetween, etc.

Any practical and secure design for a cellular phone has to assume the network is totally compromised and hostile. From this perspective, adding the radio chip and its software to that category is not actually a huge leap; it is the bare minimum in terms of secure hardware design. GrapheneOS is where the trust is placed, not the baseband, so its source code is more or less not relevant.