Actually there are very few exceptions to this, generally once installed your DLCs get updated along with normal game updates but in rare cases nintendo actually releases a updated version of the DLC itself which I think is cumulative so you won't need to have the original version installed and can go straight to the last one, maybe technically you can say it's not a update because it's a standalone file that works out of the box.
yes that's what masagrator meant. for games the Base is (almost?) never updated, instead there is a separate Update. but dlcs dont have separate files for the update, instead the dlc file is updated directly
even physical copies that have updates bundled work that way, the cartridge includes the Base (usually v0 but not always), the eshop ncas for the update, plus a ticket and a certificate for the update. the ticket is installed to nand when the cartridge is run, but the console runs the digital update files off the game card instead of installing them to the console. the distinction matters because physical and digital ncas are different, ncas for cartridges have distribution bit set to 1 for game card contents, but the updates bundled inside updated game cards are the same as the eshop downloads, and distribution bit is set to 0 to tell the console this is digital contents
this is at least interesting because the system doesn't let you run gamecard ncas installed as digital contents without either patching the distribution bit check, or modifying the ncas to change the distribution bit from 1 to 0. but this shows that digital ncas will run from gamecard just fine, or at least it specifically allows updates to run from gamecard. in practice it doesnt matter for us because it's not like we would have a way to put eshop files on game cards to run them anyway, but it's interesting to know how the os works
things have changed a lot over time though with firmware updates, so the details might not be 100% accurate to fw 20. but anyway. what matters is that even game cards dont update the Base, and instead a separate Update is bundled, while dlcs dont have separate updates because they get directly replaced with higher versions
Maybe when you install a game for the first time it only checks the required version list which I assume would be the minimum version the game needs to run on the current system firmware and when you update the game it uses the version list and ticks the version that the update has even if it is not the latest that is listed there.
Then the only way to run the game on a lower update would be to use a app like DBI to reset the tick?
Point is the nag would only match the most recent update that the user has ever installed for a game and not the latest present on the offline version list.
Perhaps only when you go online it validates the version list forcing the nag to a newer update.
no, the console doesnt check any kind of required firmware version when installing. it only checks when trying to run the game, and this checks the minimum required firmware version in the cnmt. more specifically, when installing, the required firmware version is taken from the cnmt and saved to a cache on nand (in system save data 8000000000000121), and the system checks against this when running a game, instead of checking the actual installed cnmt. you can install a game that has a required system version higher than what you have installed and it will install fine, but it will check that required version in the cache on nand and see that your firmware version is too low, and demand that you update before you are able to run the game
this behavior is useful for us because this cnmt cache isn't really validated in any way. it's not signed and there are no other checks to prevent arbitrary values from working (it never re-checks the real cnmt after installing). so installers for nsp and xci can just spoof it and make it write 0 to the cache, instead of the actual required system version, and then it checks and sees your firmware version is higher than 0 and it will never complain that you need to update the firmware to run a game. and because it goes by cache, this works without modifying the game files, meaning you don't need (additional) signature patches for this bypass to work and it doesnt taint your unmodified files if you ever wanted to back them up later
for what it's worth this probably could (can?) be done on an unmodified console without cfw, because the eshop doesn't always require the latest firmware version to access it and buy/download games. I know before being banned I could just access the eshop without updating after restoring my nand backup, and I could buy and redownload games. I don't remember specifically installing games and trying to run them though, so maybe all the games I had just happened to not require a higher firmware version than what I had. it's possible that the eshop does check for the current firmware version before installing a game to ensure games don't get installed on a lower firmare version. I know that homebrew nsp installers don't check it though, and that you can install a nsp on a lower firmware version and then get asked to update the firmware only when you try to run the game. and these days they periodically update the eshop servers to require updating to the latest firmware version before you can access it, so it wouldn't be easy to check. but tbh since they already had the systems in place to just prompt for a system update on game launch, it doesn't make sense to also enforce it on the eshop side