The NIM services only use the console's Device ID when downloading anything from the CDN, so it should be safe. But this is absolutely subject to change in the future.
Cartridge Certificates are a thing, and they're used in the authentication process for online play. Unlike in the 3DS days, Certs are cartridge-unique, game-unique (e.g. Certificates from a MK8D dump can only be used with copies of MK8D), and sent in conjunction with your Device ID. This means that you cannot play online with pirated copies of games, and getting banned will result in your console being banned as well, not just the cartridge itself.
The possibility of cartridge certificates being added to the CDN download verification process is a very real one, so whilst you're "safe" to download updates for cartridge games, don't expect this to be the case forever.
EDIT:
To clarify:
Playing online on a pirated game will get you banned.
Downloading updates for cartridge titles won't get you banned.
If they make downloading updates require a valid cartridge certificate in the future, it will get you banned.
If there are firmware modification checks or they're implemented in the future, it will get you banned.
The last one is an unknown factor, as no one has reported bans just for running SX OS or Atmosphere+Hekate and going online.
Yet.