Snowden, along with Greenwald/etc, are trying to explain the complex brave new world of encryption, data mining, network sniffing, exploits such as MitM, and such to a non-technical audience that makes up most of the world. Worse - it's a crash-course trying to cram what should have been a public discussion gradually happening over the last couple decades into a few short newspaper articles, interviews, and pages torn out of .ppt files.
It is a truly rare thing to see someone even attempt such a herculean task. So it's perfectly understandable if he fudges some of the minor technical details - especially when the target audience won't understand them.
He was obviously trying to get people to understand that just because you clicked some software-controlled button and saw the backlight+screen turn off ("phone==OFF" to a lot of people), the NSA could still be using it. He could have instead used that time to trying explain what stuff like soft-power, firmware, and baseband mean, but all that would have done is make people tune out and ignore the real message.
Most people don't need a lesson in embedded systems, radio, and internetworking. What they do need to understand that there's a massive power-play going on that could become something particularly nasty if left alone, and they need to understand that some of the products and services they've been sold might really be working for someone else.
The way you do this is by influencing standards. You buy the people who write the specs for chips and/or firmware that are common to smart phones.
Removing batteries a problem? Don't let them remove them or have two batteries!
All someone has to do it look at the parts list of all these various smart phones and look for the common parts. That's where you'll find the exploit.
(1) Watch the licensing process. Want to release a phone in Europe/US? You need to have the electronics licensed first.
(2) Want to release a phone in large numbers via a major carrier's retail operation? Watch their carrier pre-approval process (in the US this is months long).
Then you just reprogram the bb firmware to never switch off the baseband and to automatically start it upon insertion of a battery, and you're done. If you're good, intercept PIN usage so that you'll even be online without the user inputting the PIN.
Also, I don't buy the "the NSA doesn't have an 0day exploit yet for the new processor that comes with the phone" argument. BB firmware is usually built "take the shit from the previous version/family, put some more shit on it to support the newest feature, done". So once you have an 0day for any version of a BB chip/family, you most likely can also use it against later or derived ones.