Seems like their online systems don't reach out for the header info unless you connect to the online servers. The service for the Friend's List could very likely be decoupled from the service that provides multiplayer features for games like Super Smash Bros or Pokemon. In that case, the latter would be what validates the header against a master cache of what is currently connected to the servers. It could dole out bans if it sees more than a given amount using the same code simultaneously (2 for reference, but it could be a threshold set higher than that for error since the TTL for a header from a unique MAC might be longer than the game stays connected. Sorry for the big IT words, but I'm inferring based on personal experience with networks, caching and DNS resolving). So, in this case, you could have a game with a public header not cause an issue just being read by system software, as what identifies a cart for sharing of game info on the friends list is much more shallow than what is used to utilize specific game multiplayer features.
Either that, or I'm already under the guillotine and they are just teasing me before they flip the switch