Bad actors can spoof the battery charge reader, but it's much harder to spoof the juice out of the charger.
You have the charging electronics which will tell you very quickly when a battery is dead, and you know which subscriber gave you the faulty battery. Sure faulty batteries can happen naturally (and accidentally), two faulty batteries though should be statistically enough to trigger an investigation from the company.
Ideally this would be coupled with lax device receipt keeping so while the company could tell that one of these thousand customers that used the kiosk that day returned the faulty battery it'd be hard to pinpoint a specific wrong doer.
That said, it feels like the margins on this would be low enough to make it not worth the effort.
So the central server will reject the battery if it can't authenticate with the proper RSA private key, or that key is already online somewhere else.
Just like creditcards with chips are validated each time.