Yes, and usually yes. The 3DS cannot be exploited at boot because it does proper signature checks on things, so we can't modify the firm on NAND. However once we're dealing with stuff we can change, like firmlaunch, we can manipulate the firmware to our liking without having to worry about the bootrom. The bootrom hasn't (to the public's knowledge) been dumped, so we don't know if it's exploitable entirely or not, and we don't know how to avoid signature checks aside from somehow signing our own content.