Buyers were victims because the ten game limit is something Sky3DS established themselves. It never needed to be there for any plausible reason, despite what they'll tell you if you e-mail them.
No, they're not. They would be victims if Sky3DS had
not stated the limitation, and had insinuated that you could put an unlimited amount of games on the cart.
But the limitation was
clearly stated. It is irrelevant whether or not it was technically possible to remove it.
As an analogy, Spotify cannot be sued for applying DRM to its content, and its users are
not 'victims', just because they really, really, really want to copy music to their <insert device>. Sure, Spotify established this DRM themselves. The reason they did this is irrelevent, but this is an
established limitation. The customers are
aware of this limitation, yet they still subscribed, so they
must abide by it.
When you agree to buy a product, you are agreeing to the associated Terms and Conditions. You're not a victim because the product is not how you would
like it to be. Rather, you would
only be a victim if you were told something that was not true, which does not apply in this case.
Edit: another analogy I just thought up. Could Gateway be called 'perpetrators' (and their customers 'victims') in the old days when there was only one game per microSD? Could you argue that multiROM was possible and that the 'one game per microSD' was a self-established limit?