Since there are numerous ways Nintendo can be aware of your region without ticking the "share information" setting, I assume merely connecting to online play with an out-of-region game is as dangerous as using Pokemon Sun/Moon online before the release date. In the latter case, they only needed two things:
- The fact that you're online with that game
- Whether or not you connected before the release date
In the case of out-of-region games, it's similar. All they need are:
- The fact that you're online with that game
- Your region
One's region might already be associated with one's Friend Code, etc. and stored server-side. Back in the Wii days, I remember there being evidence that Friend Codes were already grouped by region.
Hypothetically, I could possibly see there being a mismatch between what Nintendo thinks your system version is (perhaps from an attempt to access the internet browser on an outdated system version) and what ctr-httpwn reports. I think this is unlikely, but if I were Nintendo, it's an option I would explore.