There are some universal legit CIA files (games preinstalled on 2|3DS consoles). They have valid signature for all consoles (from the same region I guess). It is possible to ntrboot into Luma3DS, load FBI via Homebrew Launcher (Rosalina injection) and install universal legit CIA files. They will work after a reboot without Luma.
If I remember that correctly there have been ways to install legit CIA files without full custom firmware on low firmware versions – but I know nothing about this as it was before I started reading about 3DS modding.
The "mostly no" is for all the other games but the few that exist universal legit. No CFW, no valid signature → No starting games.
I personally can think of no reason for not having CFW on a 2|3DS. The best way is simply installing CFW on the new console.
Then you just going have to pay for the games instead then , at most you can only get the legit cia that KleinesSinchen mentioned about, if you want unsigned cia then you need to install CFW and then install games in CIA format, I don't get it why you don't want to install CFW, not like you would get banned for installing CFW these days on the 3DS,
if bricking is your worry, there's almost no way to brick, and if you were to somehow brick, there are ways to fix it. with a9lh, brick risks were high due to not apps not verifying things. now, both b9s and nand backups contain a sha file to verify before install. another problem with a9lh was that it wouldn't verify if a system was an old or new 3ds when installing, so using the wrong one would cause a brick. that is no longer the case.
I don't know about getting banned. I always assumed I was, but it's been said that it's difficult to get caught on the 3ds unless you were to play a game early.