No virus scanner understands how to run game console executables and could detect unusual code layout in ROMs, nor do they want to because those aren't viruses.

I’m not sure which rom hacks were being flagged, but most consoles use CPUs that were also at one point used in computers or phones as well. Is it likely that a virus scanner is going to flag a MIPS binary (PS1, PS2, N64)? Probably not. But what’s the difference to a virus scanner whether an x86, PowerPC, or ARM binary is meant for a console, phone, or a computer.

Or more simply, it could be packed with a README that links back to a modding group that hosts stuff on a site with malware or other “hacker” tools.