I agree that malicious firmware could cause the battery to combust, but I don’t think it would be lethal except in the rarest of circumstances. When li-ion batteries fail, they usually don’t explode so much as rapidly catch fire and spew toxic fumes. As an attack on a person, I don’t think you’d achieve much more than some burns and maybe respiratory irritation. It would probably be more successful to use it to start a house fire when no one is looking.

But also, the agencies capable of doing this aren’t spending the resources to do it on some random person. They were targeting very specific people.