I can't understand how a newer console can have thousands of exploits and this console only have a exploit which is not in the system and you must pay for it.
3DS is Nintendo's first handheld with a real operating system, while the DSi has no actual background processes that could be exploited from an "userland" exploit
Like with GBA/DS, all the system functions usable by applications are run directly from the unprotected bootroms or compiled by the sdk into the roms themselves
Security on the DSi works with hardware registers you can't reenable without resetting (like why you must have 2.1 or less to read otp on 3ds), the launcher reads the header of applications to see what permissions they have (nand+sd? slot-1? camera? etc)
tl;dr as you already know, you can't get nand access from an iEvolution so to get more permissions we would need to exploit home into accepting a custom title, the thing is that there aren't any public exploits in the boot chain that could lead to signature patching
---
If the SDK can make retail-signed DSiware and roms (never tried) and get a friend at a bootleg game factory, we could create a physical copy of TWLNmenu and install itself (it being likely the only "official" app with both nand and slot1 access) and other tads...
The same would be doable in a more ethical way with an existing DSiware exploit (implemented without #clobberedkeyslots) and a currently nonexisting homebrew title manager...
-----
Lol I really went off on a tangent here.
Simply put: it's an objective fact the 3DS "security system" is more complex and fine grained.
And it's exactly with complexity that the chance of screwing up increases!
