This is a common missunderstanding here. The problem doesn't start when you install the fake game through the nsp. The problem starts when you run it.
Malcious code needs to be executed. This can happen through nsp, xci or a payload. Don't let yourself be fooled by the format it's delivered.
Just look at viruses or malware on a regular pc. Most of the time your problem begins when you open FREE_SONG.mp3.exe. Not when you download it.
The malware would need to be executed through any means on the right level of process elevation, before it can damage your system. The Switch is no different in that regard.