There is no danger in using emuNand to create the NNID. It will be linked with the "console ID" that emuNand is using, so anything you obtain from the eShop will be seen as "legit" by that emuNand, since it'll be signed for that console ID. The only real difference is that anything you grab will function with signature checks enabled, so if you have a retail game, you can download the update and it'll work with the retail game (as long as the retail game works in emuNand. I don't know how rxTools handles retail cards, if there's a mode like Gateway's "Classic Mode", or what). An update from the eShop will work perfectly fine, whether the original game is legit or not. An update downloaded and installed via CIA won't be signed, so it'll only work when signature checks are disabled.