Issues with only being able to save one game
No menu
No hacked games
No cheats
No region free
No homebrew
Works with existing ROM images.
That screams to me they are just cloning a commercial ROM and have a bit of logic to direct the reads from the 3ds and change them into SD card reads to allow it to work for any game, the ability to swap (save issues not withstanding) probably comes as the result of fiddling with the order of a game, some other homebrew on the DS or something like that (personally I would have gone switches on top of the cart, some switches you can connect to the cart or a detection for numbers of power ons without a SD card in the slot but that is a different matter entirely).
As Nintendo I know the 3ds read protocol inside and out, as gateway or indeed any public hacker I can infer a lot of things by watching it on my scope but I do not know everything and every tricky that can be done -- even on the DS
it was non trivial, a good example of that would be below 8000 stuff that was actively and extensively used as an anti piracy method, it had a "secure area" and it goes on.
If they are using existing dumps they might not be a full dump (no DS ROM dumped yet has a full secure area for instance, several later dumps were also missing a part of the header, a useless part but missing none the less) and then you just read the area that is not complete and you have yourself a detection method.
If they are using basic logic it might not be fast enough or it might not behave in the same manner (or indeed you could change the setup in a manner that would trouble no commercial game but might frustrate the obvious route for a flash cart). Any potential differences (more current, higher latency, incorrect responses) can be used to detect things and any differences you can detect you can use to shut things down. There is an adage in security that reads the defender has to protect against every attack, the attacker only has to get it done once. Normally Nintendo is on the defence but not in this instance, similarly modern security reads something like "if you have a virus on your computer then you have failed regardless of whether your AV program stopped it or not".
When you do this sort of thing on an established network/IT setup it is usually called penetration testing and it is a big deal in the security world. The term probably still applies here though it is not ideal, suffice it to say though you can find people versed in hacking or just speak to some of your programmers if they are good (this is tricky as the one that takes things apart is not always the one that builds it) there are people out there you can get to pull things apart and attack it.
