You should update the old3DS then and install ironhax if you don't already have it. shufflehax is basically another version of themehax that works on firmware 10.2-10.3 which were supposed to patch the exploit. Also, a new browser exploit for 10.3 was found so you can safely update and use that as an entry point (in addition you're able to use the browser if you want without any DNS blocking). ironhax is very unlikely to get patched by a firmware update, so as long as you don't update it you should be safe on any future firmware update (as long as you update the payloads).
Same can go for the new3DS but an exploit was patched for it on 10.2 that allows kernel calls from user-mode so you might want to wait on 10.1 and see what comes of it.
I had IronHax installed. For some reason when i was playing Pokemon ORAS, my game would crash (started last week, crashed 3 times but i barely even use the 3DS). I just updated the payload from 9.9 to 10.3 and updated the 3DS. Works great.
Should you update too? Probably not, but it's up to you
You get three entrypoints (shufflehax, ironhax and spider28hax) if you update. Upto you. spider28hax is the latest version of browserhax for o3DS. There is an alternative for n3DS too.
Not always true. This also poses a problem if nintendo pushes out an update to fix the hole in the security that's being exploited. Case and point, anyone who's actually still on pre 4.0 firmware.