The truth is, nobody knows why people were banned and why others weren't. A lot of data was collected and it was inconclusive. As others said, some people prefer 3dsx files as they do not show up in your activity log. Just the download play would show up if you have Rosalina injected there. CIA files show the title of the content in your activity log.
Some people like to claim that Nintendo doesn't care about homebrew CIAs, but only about ones you obtained illegally (aka did not purchase). Personally, I was banned in the first ban wave. After that I switched to using a public seed. Now, public seeds typically get banned pretty quickly. The one I'm currently using, hasn't been banned and it's been months.
Perhaps Nintendo stopped banning, or is just waiting to do so in more waves. But again, nobody knows. For every theory as to why certain people got banned, there exists too many outliers for it to be solid enough.
Personally, I attribute my ban to sending out Doodlebombs to people who requested them. Ninty didn't seem to like those.
Any game I play is installed via CIA as I like to go online with them.