Well you do if you want to receive the confirmation text. And while you’re at it, you might as well use the same cell tower for data so that you get “residential” IP.
You can definitely fake geolocation and perhaps you could fake IP through some proxy, but you can’t use commercial VPN services as their IPs are well known VPN IP ranges at this stage. (these SIMs might have been used as such proxies for some spamming besides being used for this specific botnet) Effectively the more you want to blend in with the actual Ukrainian end user traffic, the more you need to be present in the country and the more complicated it is to fake it otherwise. Especially if you’re trying to hide from state level investigation, that has access to triangulation from cell towers, providers logs, etc…