Can a flashed rom leave behind artifacts?

I found a few "unofficial" Lollipop ROMS floating around the internet.

I don't know how reliable are they, or how many viruses are there.

All I want to do is to play with it a little. I'm thinking of making an NANDROID backup, flashing the rom, playing with it a little (with no private information placed there), and restoring the NANDROID.

Is this safe? Can a malicious Rom writer intercept any attempt to flash a Recovery and keep itself on the phone (sort of like a rootkit)?