If you're only using userland exploits then the latest versions are exploitable. You just need a compatible game.
If you're going to use kernel exploits such as arm9loaderhax, you've gotta watch out.
Now, it might be a bit risky to buy from Amazon, as you might end up with an updated 3DS without knowing.
I would go ahead if you have another exploitable 3DS console to fall back onto like I did, as a 2nd 3DS will be useful when performing a DSiWare downgrade, but in other cases like your's (assuming you don't have another exploited 3DS on hand) I would think twice about purchasing.
I got my N3DS from Amazon UK back when there were plenty of easy-to-access exploits that didn't require system transfers or DSiWare. I knew I was pretty much safe in terms of getting kernel exploits, then, no matter what I did.
What I didn't expect was for my N3DS to come with 9.9 unboxed. I felt lucky, since I could downgrade and get A9LH... until SafeSysUpdater fucked up and ErrDisp kicked in, but 10.x had an exploitable kernel at the time with memchunkhax2.1 (weirdly called svchax sometimes) so I updated and downgraded again.
Whatever you do, however, don't go for the Galaxy XL model or any newer N3DS (XL) models that have come out, as they'll be guaranteed to be on 11.x and can't be downgraded without a 2nd 3DS or hardmod.