In those RF cages, the phones are basically in a deep black void, pretty easy to tell you are in a void and not a rolling sunny hill.

Or do what VW did and detect the testing station, I am sure the locations of the FCC test facilities are widely known.

If it was on airplane mode before it entered the room it wouldn't be able to tell, that'd be a useful first step.

Why? Airplane mode is a software feature right, you just don't enable whatever power transistors you use to amplify your transmission. However a receiver won't give measurable EMF, you could still listen and detect any abnormally low noise floor. You could probably even employ a heuristic like "only call home if the noise floor has been very high for at least one hour".

That would still be catastrophic for people trying to avoid tracking in demonstrations for example.

Or what am I missing?

Your phone's (rootkit?) would have to passively measure the room before any remote action, that's true and reduces the utility. Still it would require accessing the sensors in the faraday cage which might make some noise.

Plenty of VM evasion stuff has been caught in the wild so it would up the game regardless, which is all you can really hope for against hackers and malicious parties. They almost always go for the easy targets who don't think of this stuff anyway.

Good point none-the-less.