The simple fact that
they can't.
- It's an out of print title
- Due to the way the 3DS OS works, it's unpatchable without users being able to simply delete the patch afterwards
- The development team who made it went out of business in 2011 - who's going to develop a patch?
- It's a physical cart and uses an exploit tied to a system unique for that game - not an exploit in the 3DS OS itself
- It doesn't need to install anything to the 3DS OS at all. Even if Nintendo restricted stuff from being installed in the 3DS system menu itself, you would still be able to run homebrew and region free by booting up Cubic Ninja first - there's no preventing that
Yep. It's a usermode exploit. Basically, Nintendo doesn't have a way to differentiate legitimate Cubic Ninja code from homebrew code, because technically, the game has permission to call all the functions homebrew applications would use to run, say, an SNES emulator. Similar exploits on the PSP, as far as I can tell after a bit of searching, also went unpatched. When the attack vector is a game, and it's a usermode exploit, you're pretty much set.
Now, if this were a kernel exploit in some way, then Nintendo would be able to patch it on their end, but in this case, the game never tries to do anything it isn't already supposed to be able to do, so there's nothing for the OS to really detect.
And if it enables region unlocking, then this is pretty much the best kind of exploit. It's just a shame that it's only for such a random, out of print game, though I guess someone could import a Japanese 3DS and then use the eShop version of the game as a passthrough or something.