Again, there are no server checks for actual pokemon, if it goes online it's legal, not legit if it's hacked. No such thing as it being allowed online and being banned later. It simply won't allow the pokemon online. If it is allowed online, it legal regardless. legitimacy doesn't matter. Those checks are only for legality, not legitimacy.
Plenty of pokemon that PKHeX marks as invalid are legal online. Like event pokemon, you can just remove their ribbon and they aren't "This is a special pokemon that can't be traded!" anymore. But without the ribbon, PKHeX doesn't recognize the encounter, and tons of events have moves they shouldn't have. Just saying PKHeX show legitimacy, not legality. So whether or not PKHeX marks it invalid has no bearing on if it will be accepted online or not.