I've doing experiments with it and I figured how to change the batteries "safely". I have a boombox that I took apart that works with two 18650s in series, it is has a 9V input with a resistive dropper and an charging indication LED. When the battery is charging (drawing current from the circuit) it turns red, when the battery is charged (when it reaches the cutout voltage, no current drawing) it turns blue.
It should have a charging controller as well (a small sot23 transistor size IC, the extra dropping resistor is then used to prevent power being dissipated on that IC). But double check, what is the cutout voltage (should be 8.4V; if you see something like 8.7V or more, it is just the protection and it is not safe).
The curious thing is that when I try to charge the batteries through the original protection circuit with the boombox the light turns red, and it draws 0.3A, but the battery nor the protection circuit are hot, only the resistive dropper and the switching power supply, so the charging stage is ok and the circuit doesn't decide to kill the charge yet, that's weird because in leaked or damaged batteries this could result in nasty overheating and hydrogen production. But when I disconnect it from the charger I see no voltage at the output of the circuit, I stick a lamp load to simulate the camera but nothing, it could be that I haven't charged the batteries enough or the circuit decided to kill the output only allowing charge.
Nor the batteries, nor the protection should become any hot at all. If they are, something is really bad there.
It could have been the overdischarge protection has triggered. In that case it may need the full charge cycle to reset (and remeasure the battery capacity)
Could the protection chip be detecting when the battery pack is being hacked by changing the batteries? I think I can't replace the original control board for a generic one (which is likely to not have programmed obsolescence, as it is supposed go around between many batteries), but the camera have a control or communication port to the battery.
Edit 2: The reverse polarity protection seems to be working, I accidentally connected the polarity backwards to the charger and the light keeps blue.
It does not explcitly detect the cells being replaced, but it may get confused by the sudden parameter change and so assume it is a fault (an excessive leakage which leads to fireworks exhibits the same way as when the battery capacity has increased due to cells being replaced: In both cases the voltage is rising slower than it did the previous cycles the controller remembers in its EEPROM; as the design assumes no one will be replacing the cells, it considers that signature as a sign of a dangerous battery fault).
Using other controller board may mean two things:
The other board may be explicitly designed for the batteries to be replaced, so may feature extra mechanisms able to safely distinguish between replaced vs failing cells (or need some programming to be done to reset it). But with cheepeese boards from AliExpress there is extremely high risk these boards would just skip such fault detecting features and leave the cells a ticking fireworks bomb.
Definitely it is not just the batteries, what is wearing out, it is the protection IC as well. And it is then a question, if the worn out IC wont shut down the pack soon after the cells were replaced because of data corruption in its EEPROM.
Some controllers (those using just RAM and relying on at least some cells retaining the voltage sufficient for data retention) do not wear out and are reset by replacing the cells, but then you absolutely must connect the new ones in the exact specified order. And the cells must be replaced before the controller detect their degradation as unsafe to charge anymore, because then it always triggers the fuse.
Connecting the new cells in a wrong order may cause the controller to misidentify the voltage condition as a battery failure and fire the fuse. Often the correct order is to start with the most negative cell and only then connect the rest.
But these controllers have to fire the fuse way sooner than those with EEPROM, so usually are not that popular anymore. But it could be the case in your camera.