IMEI and GSM in general is one of those "industry standard" that are so heavily paywalled that the effort to reverse engineer it is pretty hard. You can look at osmocomm, the umbrella open source project that tries to make mobile communication more accessible and open

Yup, tracking mobiles from towers is a transmitter level vulnerability, pretty unavoidable (although gOS airplane mode and some other airplane modes actually works against this) if you're using the network. Maybe open hardware at the modem level would give an option to spoof, but that doesn't exist in the wild to my knowledge.

The article goes deeper into persistent international (state level threat operators, SLOs) tracking, and it's actually somewhat reassuring in so much as they need to use SMS exploits to embed trackers (so gOS updating the image every week or so would likely bork it as described if a rootkit is not available). Paranoia suggests this is well below the actual capabilities of the SLOs but you do what you can. If there's a significant threat to life or liberty, leave the phone at home. If your threat model also includes international usage (wherein these exploits exist), burner at each country.

Disclaimer : I am not an expert, just a rando interested in liberty.