[Android Software/Hacking General [Developers Only]] CosmicDan:
There's no such thing as owning software unless you created it yourself from scratch. Even if it's free/free (libre, as in free beer) open source, you don't own the software. You still have to follow the laws of the license. And even if you did create the software yourself, you are still bound my the license agreement of whatever IDE('s)/SDK('s) you used to write it. (E.g. it is illegal to sell software, or use software in a commercial environment, if it was created in Microsoft Visual Studio Express).

This goes the same for apps that are not open source, e.g. Xperia S Launcher or HTC Keyboard, and many apps on the Play Store. When you bought the app/device, you do not own the software, but you are legally permitted to use the software as defined in the license agreement. 95% of closed-source license agreements deny the permission to reverse engineer these files, so as soon as you use APKTool on an APK that is not open-source, you've breached copyright law.

With that said, most OEM's don't seem to care too much about XDA and various other website developments about porting proprietary vendor packages to other devices. They just don't have time or resources to chase these people down and try to sue them (I mean, they're not Apple heh) - it'd cost more money than they'd feasibly get. OTOH, some developers, such as Xiaomi (MIUI ROM creators from China), actually congratulate and share public releases of their closed-source packages being ported to non-MIUI devices and ROM's.

If you do your research, there is no argument to stand against it being illegal - it's a fact. But that's not to say it's wrong, and not to say the OEM's are too bothered about it. After all, they get a bit of publicity about it (some time ago, I switched from a HTC to a Sony device because I was much more impressed with Xperia's UI and stock apps which I used on a hacked HTC device).

Regarding bootloader/unlocking/rooting, not all manufacturers demonize it. Sony provide an official means to do it - as long as the provider has not blocked bootloader unlocking (which then requires specialized service - as said, this is usually in the case of a plan because you don't actually own the phone yet).

With that said, I will answer the original question -

It is not illegal to install a custom ROM on your phone if you own the phone. However, there are two points to consider - firstly, do you actually own the phone or does your carrier? Secondly, if it includes Google Apps, it is illegal. CyanogenMod project had to remove Google Apps from their ROM's some time ago because of a license breach (the OEM's have to pay Google to release a phone with Google Apps preinstalled).

So the only 100% legal ROM is Cyanogenmod without Google Apps, or your own AOSP compilation without Google Apps. So obviously, Google and the OEM's don't care too much about custom ROM's - because techically, 90% of them have actually broken the law somewhere. It's just not worth their time to enforce these laws, especially since these devices we buy usually have Google Apps pre-loaded already (so it's a legal grey area really, they can't prove anything in the end).