Clip bypass battery to the power/gnd pins while desoldering and resoldering.
Read RAM image before desoldering. Write image to RAM after resoldering.
For that matter, read RAM image from old battery and write it to new battery, no soldering required. Or MITM the connection between phone and battery, and the bypass device can pass-through battery health information while intercepting and responding to authentication-related signals.
You will never be able to enforce hardware security indefinitely against an attacker with device-in-possession.
What if the chip uses asymmetric cryptography for authentication with a private key stored in it, impossible to recover, just like a credit card? In this case it can’t be spoofed by intercepting the comma between the phone & chip, private key can’t be extracted, etc.
Sure, a bypass battery is possible. The point here isn’t 100% security (which as you say is impossible), it’s to make the operation difficult enough that most give up or have to charge more than an official battery replacement.
Dissolve the chip casing in fuming nitric acid and use probe needles. The official pins are not the only way to interface with the silicon, when you have device-in-possession.
Use a timing attack. Find a collision.
It is very likely that the same private key is locked up inside every chip, and one reverse-engineer, probing one of them once, can compromise the key for all of the chips manufactured before their publication date, and probably would last until the OEM ran out of those chips, and then deprecated the key after some time with a software patch. The one-time cost would be worth it for any manufacturer of off-brand batteries.
The battery controller chip is not going to be an impenetrable security vault, in any case. The cost of parts is a factor, even for Apple.
Asymmetric keys don't work if the attacker is in possession of the private key, no matter how many padlocked boxes you put it in. The attacker has the key, and getting it out in usable form is a matter of time, not possibilities.
Read RAM image before desoldering. Write image to RAM after resoldering.
For that matter, read RAM image from old battery and write it to new battery, no soldering required. Or MITM the connection between phone and battery, and the bypass device can pass-through battery health information while intercepting and responding to authentication-related signals.
You will never be able to enforce hardware security indefinitely against an attacker with device-in-possession.