The emulator scene could have all the trust it wants and it was still ruined 99% of the time by people downloading ROMs from the first sketchy site that gave them a file download. At least here what is made quickly by an LLM can have its source reviewed even more quickly by an LLM for a decent assurance. Age always helps though.
Exploiting an emulator through a ROM is significantly harder than inserting some malicious code into a binary.
You're thinking too much like an engineer who reads code all day.
What's actually happening is a 13 year old downloading Pokemon.rom.exe and clicking on it.
Your example might be a couple of decades out-of-date.
They meant Pokemon2.rom.exe