Safe? No. PKHeX can't verify the authenticity of an arbitrary HOME tracker, nor can it fetch HOME's tracker side-data to see which games it has visited. But, anyone who has your PKM file can try uploading into HOME and then dump HOME's side-game data from RAM to confirm it never visited.
If you are looking to modify data that is only available in specific formats, then it must be transferred there first, obtained (legitimate or not), then transferred back to your desired format, otherwise it won't have the server data it should have.
If you transferred it to BDSP then back, then added the BDSP ribbon, then the server would be able to confirm from its logs that the ribbon was never obtained during a valid visit, and was thus hacked. Have they actioned this? No. Could they? Sure. By definition, not safe.