It requires cooperation between hardware and software. IOMMU isolation needs to be respected by the OS and it needs to avoid trusting the memory it configures the baseband to be allowed to access. It's a standard feature on all Pixel phones and also most other decently implemented modern phones. Components like Wi-Fi/Bluetooth, GPU, SSD, image processor, and much more are also isolated.
On the Snapdragon Pixels, Wi-Fi/Bluetooth is a sandboxed process within the same baseband RTOS as cellular since there's a shared baseband for cellular, Wi-Fi, Bluetooth and GNSS (GPS, GLONASS, etc.). On the Tensor Pixels, there's a baseband for cellular, another for Wi-Fi/Bluetooth and another for GNSS.