It's been said that when jailbroken non-unlocked 1.0.2 iPhones are upgraded to 1.1.1, the previously installed applications actually remain on the phone, although inaccessible. If it's possible to replace one of the native applications with a modified version, maybe it won't be updated by the 1.1.1 upgrade (since at least some stuff remain). If this is the case, it allows to put in something that can be activated once the phones is updated to 1.1.1 (all this assuming a non-unlocked working AT&T phone after the upgrade), creating something akin to a backdoor into the device.

If I'm bluntly mistaken, please don't shoot.