I would have assumed most services are normally handled by Arm11. Arm9 could probably do these things too perhaps, but one would have to use Arm11 code instead as you would just be reinventing the wheel so speak and one does not really need to do that.
Arm11 Kernel once exploited should have access to all the services. Ninjhax did not originally exploit the kernel I think and was entirely userland and limited to the services Cubic Ninja originally had.
Theoretically, once Ninjhax is ported to the new webbrowser exploit, kernel access could be added and one could setup enough access to the needed services to use a CIA installer.
Even then you'd still need a Gateway to ever use the installer once installed, but it certainly would allow homebrew devs some added breathing room as they won't have to use pirated software to install their product.
Gateway flashcart by itself is not piracy. It's all up to what the end user decides to do with it. Sorta like the Guns argument where guns do not become murder weapons unless someone decides to point it a person and pull the trigger.
You can argue all day the intentions of the person/company who created said gun/flashcart, but as of right now, Gateway doesn't force you to pirate things to use it. Nor does the maker of guns force you to use it to kill people. So the end user chooses what the limits shall be.
EDIT:
Another idea. I am aware that trying to add the needed service for CIA installation to homebrew built as CCI/3DS causes crashes. But has the same been said for proper retail games? Why not try and rebuild the Cubic Ninja rom to have the needed services?
Obviously it will still require a flash-cart to run it. Leave it up to the end user to decrypt and rebuild their personal copy.