Most people believe that you'll probably never get into legal trouble by using MAME. For the "classic", pre-1990 games, this is almost certainly true, as the market value of the ROM images is negligible. However, some recent, post-2000 games have been added to MAME. Some think such games should not be included, because they risk unwelcome attention from the copyright holders. Certain people quote a "5-year rule", stating that 5 years is how old a game should be before being emulated in MAME. However, there is no legal basis for a such a rule. The website mame.dk was shut down due to a dispute with a copyright holder. It was reopened for awhile, and it is currently closed again, claiming that the bandwidth costs more than the revenue generated by the website. At one point, the MAME team suggested that they adhered to a 3-year rule. MAME currently operates under no real "year rule" as such; instead when MAMEdev feels that a game is no longer being manufacturered or no longer popular in arcades, only then will it be added, and not a moment sooner, though at the time of writing, the most recent game added to MAME was three years old. There are two reasons for this rule: to avoid harming the profits of arcade companies, and to lessen the possibility of future lawsuits. They fear that, just because MAME has not yet been subject to legal action, doesn't mean it will never be.
Many copyright holders are currently ignoring the ROM distribution activity. This may change in the future. Some people argue that, as long as it's for personal use and the user isn't selling the ROMs, it's perfectly legal. They argue that the copyright holders have abandoned their copyright by not enforcing it for many years; most of the games are no longer being manufactured. The actual legality of ROM downloading depends on the country, although most arcade games are still protected by copyright in almost all jurisdictions, and will remain so for decades yet. The MAME community has shown itself to be reasonable. When one company requested that ROMs for its games be removed from mame.dk, the maintainers of that website immediately complied.
The RIAA is cracking down on filesharing users for trading songs. The same may someday also happen with ROMs for all kinds of gaming emulators; ROM sites have been targeted in the past by the IDSA (now the ESA). If an individual did get sued by a copyright holder, they would probably feel compelled to make a legal settlement. If they were to choose to fight the claim, they would have to spend a large share of money on their legal defense, even if they ultimately would win; so settlement would probably be the most viable option.
It is rumored that the operators from the mame.dk website have shut down their site because they were concerned about personal liability, and not because of the expense of running the website. Someone who obtains a set of ROM images probably faces a much smaller legal liability than someone who has distributed ROMs to several other people, and will usually not be prosecuted as it is not profitable for the company.