> Why go through test points rather than directly detecting RF emission?

I'm guessing it comes down to making sure the signal is from the phone and not from an external source.

All modern wireless protocols have multiple devices share a single frequency range. Thus just listening for traffic on those ranges with an antenna will produce false positives.