I guess one would generally be safe with a known hash, but ROM hacks would be dangerous territory.
Isn't Project64 on version 3.X now, though? A quick glance at their webpage suggests that they are, and I only noticed download links as far back as 2.X.
Yes but a lot of people use and circulate 1.6 as the "last good release" before the nagscreen, at some point between current release and 1.6 they also bundled adware in with the installer