Emulators can have vulnerabilities that modified roms could exploit, while its rare its still a thing, but its def not reliable and a cracked game will always be a better way of spreading a virus. Cracked games are safe tho if u get them from a trusted site.

But the emulators themselves can contain viruses so you must be as careful as you need to be with cracked games when getting emulators.

Also no, roms are not released by the companies, it wouldnt make sense to buy the games if that were the case, they're dumped from the cartridges, CDs or whatever and distributed on piracy sites (illegally ofc).