Comment by svnt
My best guess is explosively formed penetrator in the display.
I don’t think wholesale replacement of the pagers was likely to work for a number of reasons.
They had to go one step up the supply chain.
The EFP display could be set to trigger on a certain message, or even the clearing of a certain message, which in devices without said display would do nothing.
The display is most likely to be pointed at the user’s face, or opposed to their waistline (EFPs sort of fire both ways but in one axis.
The battery, if it were a cylinder as would be likely, would fire tangentially, likely not hitting much.
A prismatic battery would make a good place for an EFP but difficult to interface with and likely requires a second compromised component.
Theory: A prismatic battery with an explosive core and an electronic fuse swapped to trigger the explosive instead of disconnect the battery. Firmware change to short the battery. No visible signs of tampering even in iFixit like conditions.