The NIM services only use the console's Device ID when downloading anything from the CDN, so it should be safe. But this is absolutely subject to change in the future.
Cartridge Certificates are a thing, and they're used in the authentication process for online play. Unlike in the 3DS days, Certs are cartridge-unique, game-unique (e.g. Certificates from a MK8D dump can only be used with copies of MK8D), and sent in conjunction with your Device ID. This means that you cannot play online with pirated copies of games, and getting banned will result in your console being banned as well, not just the cartridge itself.
The possibility of cartridge certificates being added to the CDN download verification process is a very real one, so whilst you're "safe" to download updates for cartridge games, don't expect this to be the case forever.