The Switch can trivially verify the original ownership by parsing the ticketblob for properly installed, RightsID-signed titles on a primary console (which is the only place they could be). Thus, it will authenticate any software on said console as valid regardless of the account trying to boot or go online, and will be granted a valid dauth token so it can access online.
On a secondary console, however, this would not be possible without the Primary Account logging in and authenticating the ownership for a "wrong" console, basically acting as a temporary granting of a license or RightsID. This is why an internet connection is required, otherwise the Switch will not be able to verify ownership and won't launch the software nor would it be granted a valid dauth token for online.
This is why this works, and why it works on any console.