Arguably the only way to legitimately get ROMs is to dump original cartridges that you own. You can use a device such as the Retrode: https://www.dragonbox.de/en/183-cart-reader ( note they are out of stock... )

You could build your own by following information on github, but it is very difficult. See https://github.com/sanni/cartreader

You could potentially buy a NES Classic and/or SNES classic and dump the firmware of the device to get the ROMs "legally". Doing that would defeat the point though; since you would need to continue owning the device to "own" those ROMs.

A newer device to dump ROMs from many cartridge types is the "Retro Freak". They were violating Copyright/License of Retroarch though, so all of the devices have been pulled from places that were selling the device.

Realistically the only way to get ROMs is to download them "illegally". It is definitely illegal, so nobody is going to help you with that.

See https://www.nintendo.com/corp/legal.jsp#roms for the official stance of Nintendo in relation to ROMs. Fragment of text from there: "whether you have an authentic game or not, or whether you have possession of a Nintendo ROM for a limited amount of time, i.e. 24 hours, it is illegal to download and play a Nintendo ROM from the Internet. " They also seem to imply that they believe ROM dumping devices are illegal too. See the section there on "game copying devices".

See https://www.howtogeek.com/262758/is-downloading-retro-video-game-roms-ever-legal/ for a more extended discussion of ROM legality.