The problem is that, while the main processor can be secure and free from backdoors/spyware, and the serial+audio lines out of the radio module can be heavily monitored, or electrically disconnected, the radio module itself still runs unvetted firmware, and could (if you're paranoid) do a wide range of nasty things with the data going through it.
Whats more, the radio connection is almost entirely controlled by the tower (which necessarily tracks you to ensure correct call routing). The tower gets to instruct the radio controller about encryption, what to connect to, and a range of other things. Since anyone can set up a mobile phone tower, and the telecoms companies may not be entirely trustworthy, the only safe things to do is to turn the radio off (or some low power mode where it couldn't possibly have sufficient range to contact anyone) and to end-end encrypt any data you send to the radio module.
The side of privacy we can do something about is that where Android devices (for example) love to send everything to google to sync with your google account. That isn't about it being a phone, but about it being a device that can connect to a public network.
The Pyra will likely be a good device for instant messaging (whether by SMS, Twitter, IRC) but a poor telephone.