You're forgetting about so-called "hardware-based anti-piracy measures" which are implemented to prevent this from happening. As I've mentioned, the chips are proprietary, making it hard(er) to fool the system. I'm not entirely sure what's the difference between normal 3DS storage chips and off-the-shelf ones, probably some stuff in the memory controller low-level programming, but I can tell you how it worked on the Neo Geo Pocket.
The reason why there's only one flashcart for it is that the system actually checked for the storage chip's manufacturer ID, which is hardcoded into the chip and cannot be altered. Since you couldn't get memory manufactured by SNK, there were no flashcarts for the system. A flashcart for the NGP popped up recently, once FPGA's/ASIC's became more affordable and it became possible to fool the system into thinking that the attached modules were indeed SNK-made. I'm sure the 3DS also uses tricks akin to that, so "cloning" a cartridge would literally require you to know and understand the low-level workings of the cartridge and the system, down to the ALU's.