Apparently, the modem firmware is preinstalled on the device and loaded to the modem by Replicant at boot time. That could be considered as a security flaw.
Fortunately there is a solution . But it would be nice if any developer could improve that solutions so that users could easily choose if they want to be be connected (and tracked) or disconnected (and not tracked) with a graphical app, just a button to turn the modem on and off, without having to connect to a computer to run those adb commands.
My request is that Replicant boots with the modem off by default, and then it asks the user if she wants to start it up. The app could have a button you can always press to turn the modem on or off on the fly. It could also have the following options:
a) When booting, keep modem off and ask the user if she wants to start it up (default option)
b) When booting, keep modem off
c) When booting, turn modem on
This app should not interfere with the new Wi-Fi capabilities of Replicant. Users then would be able to be online through a Wi-Fi network without being GSM-located.
I hope someone can make it within Replicant, or as an app on F-Droid for the time being.