GPS in 3G or later is integral to Baseband Processor which is a separate ARM CPU that runs its own RTOS. If your adversary gets to push BP patch over SMS you're probably owned no matter what OS you run on Application Processor.

What’s the story Apple/Samsung etc tell for GPS to be this leaky? Shouldn’t the GPS be solely handled by the OS?

There's only so much you could without making your own modem... Current cellular modems are autonomous and integrated. It's architectural.

Graphene suggests that it uses iommu and similar hardware on supported devices to mitigate (some) attacks like this.