Yeah, it's installed to the savadata, but it's console specific, and can only be installed through *hax.
--------------------- MERGED ---------------------------
"This is the second savegame exploit released by ShinyQuagsire in less than a week, after
Supermysterychunkhaxreleased earlier this week. Just like the Pokemon exploit, the (v*)hax will require you to have a “primary” entry point, that is another hack in order to actually install the exploited savegame on the console, such as
browserhax, or the
cubic ninja exploit,. You’ll need the help of a friend who already has a hacked 3DS, or this could be useful for people who already have a hacked console, as a “safety net” of sorts."
SOURCE:
http://wololo.net/2016/05/01/3ds-vhax-released-new-3ds-userland-exploit-for-game-vvvvvv/
--------------------- MERGED ---------------------------
So maybe you can install it with another hacked 3DS, not sure tho.
--------------------- MERGED ---------------------------
Okay, read up a bit more. It's all through the cartridge. It's installed to the cartridge. So you need that cartridge put into a already hacked 3DS, exploited, and then put in yours. That's why it worked in your case. So unless he already has another exploit or hacked 3DS, he can't do much ;~;