As has been said about 18 million times but for some reason is not yet drilled into people's heads, there is no such thing as a safe CFW. Not even emuNand. Not anything. If you aren't willing to accept a ban, don't mod your console. There are so many ways for Nintendo to tell that you played around with your system, too much to even go over. Emunand is not an effective barrier to prevent checks for things we don't know if they are checking for - you can envision Nintendo evolving their anti-hax measures to an Xbox Live style 'challenge/response/' system, where things ranging from autorcm to errata relating to essentially having two copies of the Switch OS on one console (TX's emuNand is pretty bad, there is no full blocking of writes to the real eMMC; it lacks the level of isolation needed to seriously attempt hiding from Nintendo) - where those things are checked in a manner preventing visibility into what is being checked. And they just hand out a ban for violations. And we can't see what they are doing in a viable manner.
Vendor targeting of select consoles, the changing the checks frequently and adding new stuff on the fly, all manner of badness on Nintendo's part is possible. We don't really know what they are doing now, because there is no Switch Scene equilviant of the ABGX360 people - experienced scene figures that constantly monitor what the vendor (MS, Nintendo, whoever) checks for and devise ways to fight it. The Switch scene is stuck in the guessing state. Nintendo doesn't make it easy, either, with them delaying banning people for some semi-random amount of time, making deducting the cause of the ban a real challenge.
All of the above assumes that you don't make the mistake of forgetting which mode you are booted into for half a second and going online, which is not remotely a safe assumption. Everyone makes mistakes.
Paranoia over bans is silly. A Switch is $300. $300 isn't that much money to intended audience for illegal stuff - adults. It's not $50, but it's not exactly $2000, you know? Just buy another Switch. Call Nintendo, have them unlink your NNID from your soon-to-be-modded system, link it to your new patched Switch, redownload your games and mod the old one. Nintendo doesn't ban NNIDs (on Switch, anyway) when you get caught haxing, so that is relatively safe. Though they could change their policies, of course.
And, come on, get a computer. PCs are essential parts of modern life. Screwing around with USB-OTG is just silly. PCs aren't that expensive. Become an adult. Understand how things work, what you can get away with and what you can't. Trying to make one Switch act as both a clean system and a dirty one is doomed, will lead to disappointment. Trying to jury rig a phone to be a (crappy) PC is going to be unpleasant. Use the right tools for the job - a PC and a dedicated hax Switch.
