Nope, no way modem could operate a single CPU instruction or send a single sine wave of RF when powered down. And no way whatsoever for any TLA to exploit the hardware to enable power to modem when user decided modem shall be powered down. Please note that we can't take any responsibility for software you deliberately run on your device. A compromised browser is sth we can't do anything about, for example.

[edit] ooops you asked about N900. Nevertheless same applies for N900, the bupbat is too weak and anyway not connected to BB5 modem of N900. However main battery is connected directly to BB5 in N900 so it could stay active when asked to shut down. N900 has none of the advanced sandboxing and monitoring features which are unique to Neo900, regardless of the fact that modem separation being pretty good in N900, better than in 99% of contenmporary smartphones.

/j