> From a network perspective it’s indistinguishable from a 4G hotspot
Not exactly, because that would depend on how competent the network is. For a "dumb" network yes, they won't know whether it's a 4g hotspot or not, but it's conceivable that an all-knowing adversary (eg. NSA) can infer the make/model of the phone based on fingerprinting or even the IMEI.
The devices are also heavily rotated, they can also have IMEI numbers updated
To date with all of the public breach details it’s always been humint that lead to the networks being taken down