I’m not sure which rom hacks were being flagged, but most consoles use CPUs that were also at one point used in computers or phones as well. Is it likely that a virus scanner is going to flag a MIPS binary (PS1, PS2, N64)? Probably not. But what’s the difference to a virus scanner whether an x86, PowerPC, or ARM binary is meant for a console, phone, or a computer.

Or more simply, it could be packed with a README that links back to a modding group that hosts stuff on a site with malware or other “hacker” tools.