Alright, I will concede some. It is naive to not knowing what you are installing in the way of a ROM beforehand. Not doing research and checking around first is stupid.
Its just a couple lines of code for me to compile a kernel that will cook your precious Droid's CPU by jacking up the voltage. I don't even have to overclock the frequencies. (Yes I am aware that nobody will ever use my ROM now)
But I also see that gaining root on the phone, and installing a custom ROM are two very different things.
Of course they are different things. But I think you'll find that vast majority of folks who "root" their phones do so in order to install a custom ROM. And while I applaud the apparent good citizenship of the various developers who have made custom ROM's available, it's hardly reassuring to note that a malicious developer would soon be "found out," especially since initial reports of problems would be discounted as coming from people who don't know what they're doing.
Even worse, a truly malicious developer would not write software that obviously harms a device. Rather, it would be software that reports sensitive information such as credit card numbers stored on the phone.
Can't speak for the OP but there is a reason that Unix system administrators from time immemorial have not posted the root password on the wall of their offices. Once you assume superuser privileges in an operating system, much less install a hacked o/s, you should consider the risk you're running.