I think the relevant clause on the matter is this, from
Article 17(1) of the Radio Equipment Directive:
The conformity assessment shall take into account all intended operating conditions and, for the essential requirement set out in point (a) of Article 3(1), the assessment shall also take into account the reasonably foreseeable conditions. Where the radio equipment is capable of taking different configurations, the conformity assessment shall confirm whether the radio equipment meets the essential requirements set out in Article 3 in all possible configurations.
As with all such things it's going to depend on interpretation of these terms.
But it seems pretty clear to me that the extreme scenario of "phones sold as personal organizers, with firmware update on the website" is ruled out, since it would obviously be "reasonably foreseeable" that users would download the update and put the device into another "possible configuration" that should have been tested.
But at the other end of the scale, if a product is a sealed unit without any user-accessible way to change its configuration, we would normally not consider it "reasonably foreseeable" that an end user will pry it open, reverse engineer it, and modify it themselves. Even though there exist a handful individuals (like myself!) who do such things, it's just beyond any sensible definition of "reasonably foreseeable" for the manufacturer to have to consider every potential
modification of the product as being a "possible configuration" that must be tested.
So in practice you'll find yourself somewhere between those two extremes, and you'll need to make an argument for being sufficiently far from the former scenario, and sufficiently close to the latter.
Which in practice might mean something like:
- The device ships with firmware that disables the radio.
- The device's normal update process will only accept signed firmware updates.
- Before releasing an update that enables the radio, you complete full RED compliance testing of the design and issue a new declaration of conformity for it.
Or a little more strict than that, or a little less. Decide what you're comfortable with, or go ask an expert to find some case law.
But at the end of the day you have to ask yourself, what scenario are you worried about if you get it wrong? Your device is going to be competing with all sorts of "CE marked" garbage that has never seen the inside of a test chamber. Enforcement is practically non-existent. If you don't take the piss you are unlikely to ever be asked about any of this, except by a test house trying to squeeze more cash out of you.