The security measure is the encryption. Nintendo's method of using the encryption is requiring the use of the eShop to decrypt the software. Accessing Nintendo's servers directly bypasses the protection of the eShop, as easily demonstrated by the fact that you can decrypt software you don't own. The DMCA couldn't be clearer on this point "No person shall circumvent a technological measure that effectively controls access to a work protected under this title."
Was the eShop a technological measure that effectively controls access? Yes. Was it circumvented? Yes.
It defines them even clearer further in the act:
(3) As used in this subsection—
(A) to "circumvent a technological measure" means to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner; and
(B) a technological measure "effectively controls access to a work" if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work.
There's no question that in the ordinary course of it operation, the eShop is meant to be required to access the work. This bypasses the eShop.