The safety of custom ROM is debatable. It totally depends on ROM you are choosing to flash on your device. I recommend you to only install ROM that is open-source and has active developers and maintainers who will provide security patches in a timely manner. Also, your phone may be at risk but not because of any custom ROM, but because of your day-to-day habits. I have written a guide on securing Android phone, you can check that out.