One issue with using a SIM card is that it's tied to your identity. A cell tower operator would know that it is exactly this person (with such id) is using the Internet (or calling, or not doing anything, it doesn't matter, as long as you're not in airplane mode) in this particular place at this particular time. IMEI (your phone id, basically) is also visible, and it's easy to infer the device model by observing its behavior. I'm not sure whether the operating system can be determined, aside from what the ISP might infer. (So, if a VPN is used, is the device model hidden? People, help).
Also on this topic: GrapheneOS performs some actions by connecting to GOS servers, such as the Internet connectivity check—this is done outside a VPN and since only GOS does this… These checks can be switched to Google's servers. There was a discussion on this topic recently, if you're interested.
Anything a company knows is accessible to the government and hackers (unless your government does its job in this domain well).
GOS mentioned the silent link eSIM service in its social-media account. You can purchase an eSIM with Monero that works in many countries, check it out.