as someone who privately messed around with lotus before any flashcarts existed, and spoofed ceriticates just for funsies, played games online, with just some forced no-telemetry flags set.... (+ third-party private dns resolver hosted at home redirecting just telemetry and error reports to 0.0.0.0) from very public dumps of just .xci, with me just spoofing the certificate from mario rabbids and mario odyssey onto said .xci's of completely different games, such as splatoon, minecraft, mario kart 8, and so on. (at least 15 titles all requiring a "Nintendo Switch Online-subscribtion". and played with other people.)
(me personally never had my test console banned during any of my testing, but then again, times are different now)
They implemented checks for that gradually up towards 17.0.0, with 17.0.0 being the "mess around with this again and you'll get instantly banned" update. (in other words, october 2023)
anyone who will claim that you can use the exact same certificate, at the same time, without being banned, are basically just spreading misinformation. (* assuming they are playing said games, connected to nintendo and being online, of course, and not already banned)
if you don't all play at the same hour / days, it is completely irrelevant, assuming you're in the same "region".
i can attest to that some random guy working at gamestop, who dumped games at work, and played them at home, and shared them, got legitimate customers banned who bought said copies.
said person was usually source of early leaks to the switch scene as well...
not to mention this exists, and is not "FUD" (fear, uncertainty and denial)
https://www.engadget.com/general/the-morning-after-engadget-newsletter-111439608.html
people without any cfw, no flashcart, just the cartridge, which was dumped without their knowledge, can get banned .