Read-only memory (ROM) is hardware, a chip, or an area on a chip. Flash storage used to store a system image is not read-only, but the term "ROM" has somehow creeped onto it. The definition of read-only in my opinion is that you have to use a separate device to write it, it can't be writable by the device that uses it, it has to be write-protected in use.

The operating system image colloquially called "custom ROM" is software (firmware) written to flash storage. It's not read-only and it's data, not memory hardware. If it were read-only, we wouldn't need verified boot (bootloader locking) to detect malware edits in it.