The cells cannot themselves have current regulation sufficient to avoid a fire or explosion. My vague understanding from past reading is that typically, if you buy an 18650, it’ll have internal regulation, but not all do – it adds to the cost and reduces capacity. But you’d only want an unregulated 18650 if you were putting it in a device that you would trust to regulate the thing. I believe I was reading about it in the past in the context of high-end flashlights that took removable 18650s, was telling people not to try and use unregulated 18650s, as then you’re trusting the flashlight’s firmware to properly limit the discharge rate.
The battery would have to be the first point to go if the external BMS circuitry just let the thing discharge as quickly as possible. Like, if you had small-enough connections or something, I’d imagine that they’d melt first, act like a fuse.
From the video I read above, lithium batteries from reputable manufacturers tend to have blowout holes to prevent exactly this – if the electrolyte starts to boil, then they’ll start venting vapor. They may catch fire from the heat, but it should prevent the pressure buildup from reaching the point where the battery explodes. They say that counterfeit cells may not have vents that work correctly.
So I can believe that there are devices out there at risk. But I would guess that most devices probably aren’t. That is, you could maybe make devices catch fire, and that could be bad if done at mass scale at the same time, but probably most wouldn’t explode.
Even on that above 18650 that exploded, you could see vapor coming out prior to the explosion. According to that video I linked above about exploding lithium batteries, it sounds like the issue is more that on some counterfeits, the pressure release system doesn’t work properly rather than that it doesn’t exist at all – I didn’t quote the text, but they went more into depth on it after the bit I quoted. But I suppose that if there were no presssure release at all, that it could probably get more pressure buildup before exploding.