Short answer: The R4 itself is illegal according to the DMCA, and the selling of an R4 is even more illegal and laws to prevent it are immediately enforcable. Buying an R4 is in a gray area, where you can claim it is for backups and homebrew, and they cannot sue you just for owning one.
Long rambling rant:
Under the DMCA, trading or selling or even giving away for free devices/knowhow for circumventing copyright protection is illegal. So you wont find any shops selling this.
It may be legal to own one, but if they know you have it, they can sue you (if they're stupid and want to use mob tactics like the RIAA)
Practically it is impossible to know what you have on your flash card and without a subpoena/warrant they will never know unless you tell them. To get a warrant/subpoena they have to establish a plausible case in court, which is not too hard. But this is all assuming they know you own and use a flash cart. They are not shaking up end users, at least not yet.
If you share NDS roms online and they employ p2p monitoring methods like the RIAA, they will be able to subpoena your computer and attempt to sue you for that. Again, this applies to sharing, not downloading.
