The real problem here is that cell phone networks were originally (and to a large extent still are) designed with assumptions that clients will play nice. Even the carriers' contracts with other vendors are structured this way.

As an example, on certain carriers I've worked with, the carrier paid per-request for a network assisted location lookup. Access to the location service was enforced with "secret" IP address and port pairs per allowed application. This "secret" information was compiled into every approved app and was trivially enumerable by brute force or discoverable via decompilation. If I had created a malicious app that used the same port as the carriers' branded navigation software, I could incur trivially incur costs in the $xxx/hour range. Their only recourse would have been to disable that port, and with it, navigation for all their customers (until they could issue an update, which would again be vulnerable to the same attack). They could also kick my phone off the network, but if a worm was every released they'd be screwed.

Mobile networks weren't and still aren't built for general use. Like the internet at large, as time goes on they'll have to improve as false assumptions they've made are accidentally or maliciously violated.

If (relatively) few phones with undesirable behavior can take you down, you're doing it wrong.