A state (or a carrier, in theory), doesn't need RCEs to do this. In every phone, the "actual phone", what talks to cell towers, is a separate system called the Baseband. It is a full computer, storage, memory, encryption, ... and it is under the control of carriers and through them of law enforcement and the like. It is also where the microphone and mostly the cameras are connected. The baseband then passes them through to the UI, like android or IOS. It's how carriers enforce disabling wifi when mobile data is active unless you pay extra, for example.

But it can copy the sound of a phone call to separate channels, or copy the data being sent (even on wifi), or it can activate emergency messages or broadcasts. It can also transmit audio and video when the phone is not actually in a call. That sort of thing.

In practice there are a great many different basebands and of course most states couldn't be bothered to actually write a decent system to use them (well, they tried forcing carriers to do it for them, but anyone who ever worked at a large carrier on a big project can tell you how that went), so only lowest common denominator features are in practice accessible. That means location and getting audio. But nothing is stopping countries from implementing more. I bet the NSA has something with a lot more features, for example.