Maybe a good fix for this edge-case scenario would be an optional feature to normally refrain from connecting to the networks (i.e. airplane mode) but to override that and connect straightaway when an emergency call is placed?
This would be true assuming the phone has not previously been compromised. Not a safe assumption considering baseband backdoors have been found in the wild and are suspected to be fairly wide spread. https://redmine.replicant.us/projects/replicant/wiki/Samsung...
This is true -- and if you're happy with Android or iOS, then that's probably the best recommendation. But I don't use iOS, and a big part of the appeal of this for me is to be able to stop using Android.
Come to think of it, would an iphone with the cellular network disabled do?