Nintendo is 100% able to take action against pokeMMO, the thing is they just haven't, yet. They are not unable to do anything, that doesn't make any coherent sense to how they treat fan work, and a fan project that profits off of microtransactions and is designed around them like an official F2P MMO.
All server calls can be obtained through packets observation, the fact that the game is running through Java makes this process much easier than if it was not, unless for some reason their server uses a completely different coding language.
Ofc its possible, but the likelyhood of someone doing it is small.
I don't know how we can talk about ethics when the team is monitizing a game they do not have any rights to. The fact the game exists to make money is a pretty easy give away that there should be free, better, and open source alternatives.
My background is in the black desert emulation scene. Our earliest private servers that I can recall were in java, and that was always the nightmarish part about them. They were incredibly easy to bypass obfuscation and incredibly easy to sniff packets from. Private servers using C# and the official retail servers use msql and C++ are much harder to get info from but it is still entirely possible.
Having a fan project, that has no involvement from TPC or Nintendo has no right being closed source and monetized. The fact they have the worry about 3rd party clients is on them for solely hosting the servers and not allowing player hosted servers.
For example, anyone could make, say, a fan made Zelda MMO that required a bunch of ROMs to use but was still closed source and had freemium level monetization. However, that doesn't exist because people have made an open source, player hosted, 100% free multiplayer tool for those games. (OOT and Majora's Mask currently) If someone now came out with a closed source MMO of those games that had awful monetization, it would die almost immediately.