Airplane mode more or less disables the phone's transmitters, but not necessarily the receivers. Even if the baseband processor is told to shut down the radio, it can still be listening for a remote backdoor message, and subsequently enable the transmitter for some nefarious purpose - similar to a remote shell.