I do not believe the story of "malware caused the batteries to explode".

This is likely disinfo by intelligence services to both instill more fear in their targets and obfuscate the real method.

Likely they intercepted a shipment and installed a small explosive charge that could be set off remotely.

Thermal runaway batteries can cause bad burns but will not blow limbs off or injure multiple bystanders.