It is not legal have a copy of a ROM file that you do not own a physical copy of -- this is sort of like the legality of music downloading. Distribution of ROM files still under copyright is illegal -- this is why we use patch files.