For emulators which use recompilation techniques, I suppose it's technically possible to make them execute malware. But writing your malware in legacy XBox/PlayStation code to embed it in roms would also make it some of the most sophisticated in history just to infect a handful of retrogamers so I think it's very unlikely..

Search for some emulating communities and see what sites they have recommended. The ROMs aren't dangerous, but there are dangerous sites that promise ROMs.

Its easier to just infect a crack for a popular game and get a ton of windows "power" users to install it.

Anything you download from unknown sites can be risky. You don't even have to run the file in order to start the infection.

Like others have said, any file can be dangerous. You need to be diligent in picking where your ROMs come from, if it's a sketchy site don't use it.

That being said I've been doing similar activities since I was like 12 years old and have got a virus exactly once, and it was completely my fault for not listening to my gut (disregarded some red flags because I really wanted something to work.)