You could download full games directly from the official online store servers using a homebrew front end. They did all the purchase auth on the 3DS but a hacked firmware could bypass it.

They didn’t put the game file download process behind an auth layer until very late in the system’s life.