They won't even need to do a Pokémon update unless they want to rigorously detect what's hacked or not.
It works on the original 3DS models because of a buffer exploit in the original 3DS Internet Browser, and it wouldn't work on the New 3DS because of the new browser engine — probably without the exploit in it. The exploit would then make edits to the 3DS RAM — the reason it works on Pokémon right now is because the save data is already loaded, largely unencrypted, in the RAM.
But once they have the Internet Browser buffer overflow patched, it's game over — unless you don't update. The damage is already done — with people able to hack again, things are going to go to hell really fast, and all you'd need to do is have a couple of un-updated games. Want to keep running and trading the exploited Pokémon? Just remove the game update from your 3DS. So, it's game over for everyone, no matter what happens.