I'm sure a lot of service-specific features like the eShop aren't even enabled yet, but in terms of what the device can do in the menus out of the box, I'd like to hear whether there is an Activity Log. (I'm hoping it hasn't been entirely shunted to the forthcoming Parental Controls mobile app; I like my stats.)
It would be best for the retailer (and the country) if no one even knew what country he was in. Otherwise Nintendo could potentially track down the retailer or give out later shipments to that country in the future.
He is safe obviously, since he did nothing wrong. It's the retailer who might get in a shitload of trouble.