Vintage gaming community.
Rules:
If you see these please report them.
Like others have said, any file can be dangerous. You need to be diligent in picking where your ROMs come from, if it's a sketchy site don't use it.
That being said I've been doing similar activities since I was like 12 years old and have got a virus exactly once, and it was completely my fault for not listening to my gut (disregarded some red flags because I really wanted something to work.)
For emulators which use recompilation techniques, I suppose it's technically possible to make them execute malware. But writing your malware in legacy XBox/PlayStation code to embed it in roms would also make it some of the most sophisticated in history just to infect a handful of retrogamers so I think it's very unlikely..
Search for some emulating communities and see what sites they have recommended. The ROMs aren't dangerous, but there are dangerous sites that promise ROMs.