You are right. But active attack could be detected, unlike passive one. That's the point why encryption and cell status might be useful ;-)

It might be useful even to provide interventing warning like "the call cannot be secured, do you want to continue the connection"?