Do you have details on the librem5 implementation to back those claims ?
I didn't find much on this, except that the iMx6/8 doesn't exist with integrated baseband, so it will by design be separated. I don't think the memory bus of the iMx6/8 can be shared (in the idea that there are 2 chips reading/writing on the same RAM), so it would need its own memory. At this point, we are close to the Neo900 design, and the attack surface reduced a lot compared to standard phones.
The remaining things not clear is if they went with a hardware way to monitor and power down the baseband, and how the audio input is connected to it ?