Yeah, you don't exactly see 'lawful intercept' code getting checked into AOSP. It's basically all handled by the baseband AFAIK.
The risk is reduced here though because they have removed almost all the sensors, so even if you used the baseband to transmit the mic it wouldn't achieve much. Your position could still be accurately tracked though.
Seems like adding a (nationwide) pager to the loop could improve that situation. Phone is in airplane mode, gets a page, user decides to exit airplane mode or not, if they do, phone calls outbound to a personal PBX and is patched in. All while the inbound caller hears ringing.
The risk is reduced here though because they have removed almost all the sensors, so even if you used the baseband to transmit the mic it wouldn't achieve much. Your position could still be accurately tracked though.