It’s a risky move to download files from untrustworthy sources. At the end of the day, it all comes down the source. If you get a ROM from a source that’s reputable and used by many, the file might be clean after all. But if you get it from an unknown source, it could be infected, so be careful.