It is illegal to perform an unauthorized download of copyrighted material in any form whether or not you own a legally distributed copy.
However, it IS legal to copy an officially distributed piece of copyrighted software as a personal backup, as also concluded in the Sony vs. Conexant case that stated:
"Any purchaser of a copyrighted software program must copy the program into the memory of a computer in order to make any use at all of the program. For that reason, 17 U.S.C. Section 117(a)(1) provides that it shall not be an infringement for one who owns a software copy to make another copy"
Though whether or not creating a ROM image specifically is legal has been openly debated. Primarily because of the ruling in Amiga Vs. JS&A Where the use of the PROM Blaster to copy the magnetic catridges was NOT protected by a user's right to copy software.
Whatever the case, it remains illegal, to distribute legally made backups without authorization from the copyright holder.
The rules above apply regardless of any ROM copyright holder's rules and policies. Though no court ruling has tested the concept that purchasing a game might bind the consumer into a legal contract giving the manufacturer the power to apply additional restrictions regarding the game's usage.
Copyright infringement is a criminal offense, but it is typically the responsibility of the copyright holder to initiate any sort of prosecution. However, It is often too difficult or impossible for copyright holders to obtain sufficient information to prosecute individuals who copy and distribute ROM files. Because of this, ROM distribution between individuals is generally considered a safe practice. However, this does not hold true for public file hosting and distribution where the copyright infringer can be identified.
The typical response to copyright infringement is a "cease and desist" letter detailing the copyrights that have been violated, and informing the infringer that failure to remove the content will result in legal action. Extreme cases of copyright infringement may be considered a federal offense which could result in up to ten years imprisonment(see the No Electronic Theft Act, 18 U.S.C. 2319).