Are ROMs not protected by the ESA legal?

"ESA protection" means that the company that published the game is a member of the ESA. The ESA actively pursues those who host illegal copies of member's games. Not being covered by the ESA does not mean that the ROM can be legally downloaded, just that the ESA does not enforce copyright on that game. The company that published the game (if still in business) can still enforce their copyright and sue both hosters and downloaders ofthe ROM image.