Signature checks. The Wii U operating system will not start unsigned software by default.
Games that were released on disc have an universal legit signature. Installing them is sufficient for using them afterwards without CFW.
Games that were NOT released on disc (eShop-only, DLC) don't have universal legit signature. Buying them will give the user legit signature for ONE console (invalid on all other units) → Operating system has to be patched (=CFW) to start software without signature.