There is a hardware vulnerability in the first ~18 months of Switch systems produced. It’s a USB boot mode (like DFU mode in iPhones) from the underlying Tegra chipset and is triggered by pressing the Tegra “Home” button (not the Switch Home button!), one of the Volume buttons, and Power while injecting the software you want to boot over USB. That button is exposed as one of the pins (#9, iirc?) of the right-side Joycon rail, so all you have to do is short that to ground with anything you like. 3D printed jigs are cheap and common.

Your system will get banned from Nintendo online services if you run any Switch-mode homebrew—for good reason since piracy and online hacking have unfortunately become rampant—so the most I’ve done with mine is run the standalone Hekate to dump my system’s unique keys and internal storage a few times. I’m still enjoying the system for its intended use too much to want to go offline forever, so I’m just holding on to an exploitable system for a few years until the Next Big Thing comes along.

As for obtaining an exploitable system, all you need is one manufactured before July 2018. I keep the following in the Notes app on my phone for when I see a used system for sale in the wild:

Exploitable Switch Serial Ranges

Serials beginning with XAW1:

- XAW1007XXX and below are safe to buy

- XAW1008XXX not safe to buy, probably patched

- XAW1009XXX and above definitely patched

Serials beginning with XAW7:

- XAW70017X and below are safe to buy

- XAW70018X not safe to buy, probably patched

- XAW70019X and above definitely patched

Serials beginning with XAJ4:

- XAJ40052X and below are safe to buy

- XAJ40053X not safe to buy, probably patched

- XAJ4006XX and above definitely patched

Serials beginning with XAJ7:

- XAJ70042X and below are safe to buy

- XAJ70043X not safe to buy, probably patched

- XAJ7005XX and above definitely patched

Happy hunting!