In the scenario you're describing, what would let whatsapp know it actually shouldn't register that new device in the public key repository ?

Either whatsapp knows the phone is hacking the account to a new number / device, in which case it should simply disable it, or it doesn't and then it will treat it exactly like a normal one.