To make it short and simple ...
When you start a game, the console look for the license file (.tik) associated with the game inside your console. Those tickets are needed and included when you install game.
Inside the ticket, you have the game it is associated with (TitleID) and if the game is linked to a specific console.
For games shipped on disc, it is the same as eshop release with one exception. The .tik inside the disc is not linked to any console since it is impossible to know the console that will be used to play the disc you buy at the store.
eShop game however are purchased from a WiiU/Account and are linked with the Account/Console it was purchased. If you try to run the game with your console specific ticket on another console, the game will refuse to run.
Since eShop release and disc release are 'the same', it is possible to replace the console linked tik file with the one from a disc version that can run on any WiiU.
So since the tik from disc are not linked to a console, everyone that install the eshop version with the tik from a disc version can run those without CFW.
For eShop only releases, the reason you need a CFW is to ignore validity of the tik file, since, it is either 'fake signed/created' or linked to another console/account.
Hope that answer your question.
Also, it is not possible to remove the console specific information from an eshop release tik to have it run without a CFW, because that would break the tik signature (algorithm that check if the ticket is valid and unmodified) and it would refuse to run on a original firmware.
