Is hardware hacking really required? My S3 ran the risk of losing its IMEI when I was messing around with custom ROMs, but before a solution was found, people put up guides on how to change the IMEI with software and it looked easy.
Some time ago, I cloned the ESN of my SPH-A680 onto an identical model (using QPST). When they were both on and next to one another, calling me made them both ring, and simultaneously answering both let me hear audio out of both.
I doubt basebands have really changed - it's a culture of security through obscurity, with people unaware of the details assuming they actually provide their purported security guarantees.