It’s based on how the 3DS works, and how the Pokémon game piggybacks off that function.
When one selects the sub-region and country on a 3DS device the normal way [country settings], the device actually stores a set of coordinates (based on the location) in the 3DS profile.
It appears to be normally not used nor seen, however the Pokémon area of the save reserved for Vivillon actually grabs and uses that area the moment you start a new game. The game determines which Vivillon encounter you should have based on those coordinates. People couldn’t tell there’s a difference (hidden cords, not region settings), because when you set the country settings in the device, it changes the coords to reflect that. Everyone wasn’t using CFW so there would never be a coord-country mismatch like you’re experiencing now.
The Luma region spoofing correctly sets the region and country settings, but doesn’t touch that pair of secret coordinates. That pair only correctly shows up if you use the in-device menu to set the country settings.
Thus, if you really really want to spoof Vivillon, consider doing a CTRtransfer for region spoofing. The 3DS CFW guide should have the CTRtransfer files there, and GBAtemp should have an old guide on using that to region spoof. I recommend doing that on a copy of your Emunand. All at your own risk tho.
PKHeX doesn’t create a database of OT/TID/SID and cross check if all the region data to see if they’re consistent. The legality checks are more “this Pokémon is isolated in a bubble away from real world details” kind of thing.
Anyone from the real world who took a look would know something is amiss.
Anyhow, the form is set the moment you encountered the Scatterbug/Spewpa/Vivillon.
The game doesn’t set the form upon evolution; it’s already there. It’s just that you only see it in game at the final evolution.
In an isolated bubble world sense, probably fine.