The sneaky bit is the neighbor broadcast: one clear control message tells you not just who the nearby cells are, but the control frequency of each of them. So you do not need to brute-force scan the band, you can just walk the network from one cell to the next, which turns a local sniff into a pretty decent map of the whole deployment. That matters even if every voice call stays encrypted, because the topology itself is useful operational intelligence. A lot of people think metadata leakage means caller and callee IDs, but here the radio plan, handoff graph, and coverage shape are all sitting there in the clear.