Your expectation is one reasonable expectation but not the only one. Steam, for instance, detects hackers and randomly bans them at some point in the future. Using this method makes it harder on hackers because they don't know which exploits are detected.
It doesn't help that the people that are banned are not posting full information like:
Which flashcart they use?
Do they use .3ds(z) or CIA only, or mixed for online games?
Do they replace all headers with private ones for online games, or do they use public?
If they do replace headers do they use one header for all games, or do they use headers of the same game (no Monster Hunter header for Pokemon, etc)?