they do not directly detect CFW yet.
they instead detect things you can't do without it.
for example if you are running a cia that they do not have themselves while connected to the internet, you MUST have cfw, because there's no way to do that without it.
homebrew can be started without it (oot3dhax, for example).
so running homebrew itself is not an issue.
Playing non purchased cias online is simply not as safe as it was believed. Playing CIAs that aren't supposed to exist while online is not safe.
the ban for this is not automatic. nintendo has to go through their logs, and make the call.
they mostly ban people who play pokemon online without paying for it it seems.
in other words they try to decide if it would inconvenience you a lot if you were banned.
people who freeshop without a NNID are usually ignored, because the ban wouldn't even affect them one bit. Bt if they buy a legit game and start laying nline, well then there's a reason to ban them.