Technically, SMS-CB messages come from a device called the Broadcast Center (CBC), which is part of the equipment of network operators. It sends SMS-CB through the base station controller (BSC). This cannot be done by air, this is what happens inside the network of mobile operators. It would probably be too much to explain all the network components of GSM / 3G / UMTS, you might want to familiarize yourself with the architecture of the mobile network.
So, the simple answer is no, the phone (mobile phone) cannot directly send SMS-CB messages.
Now the question is how to tell the CBC to send SMS-CB to some network cells. To do this, there are some standardized interfaces that are used for emergency alerts, for example. Commercial Mobile Notification System (CMAS) in the USA. If these interfaces are designed intelligently, they should not be abused by almost everyone who uses a mobile phone. But I will not be surprised if there are security gaps in some carrier networks, which will allow unauthorized parties to send SMS-CB, for example. through insecure Internet / SS7 gateways. But these are wild assumptions. As a rule, you should not send unauthorized SMS-CB from outside the network of the operator.
source share