There technically is a problem for the creator of the derived content. It is not quite as clear if distributors have any liability though.
Copyright in the US includes exclusive right to prepare derivative works. Just preparing, even if not distributed, without permission is a copyright violation.
A meaningful romhack is pretty obviously a derivative work. Even if one could convince a jury that the patch file itself was not, it would not matter, as the author obviously created the patched work first, in order to create the patch file.
Now, this prohibiting of non-copying of production of derivitive works is probably a mistake. It would be far more sensible to allow such creations, but only if no new copy is made and only if other exclusive rights (like public performance) are not used with respect to the derived work. But the law as written would certainly seem to prohibit romhacks.
The courts have been fairly inconsistent in rulings about derivatives that have not actually copied the work or its elements. There having been rulings that cutting pages out of a book and mounting them in ceramic tiles or even picture frames are infringing. (And other rulings that essentially identical cases are not infringing). Making baby bedding with purchased fabric with a copyrighted design is fine. Installing an alternate circuit board for a video game that speeds up gameplay is no good (Midway v. Artic), but an external device that does the same thing is fine (Galoob v. Nintendo).
The main reason Nintendo of America seldom goes after people who make or distribute romhacks as patch files is not because they can't.I strongly suspect it is a mixture of it not being sufficiently clear cut that they would win (and they don't want the precedent if they lose).
Its also possible that there is some other reason. Perhaps NCL is reluctant to let NoA do that for some reason. (Which would seem weird, as if anything NCL's mindset would be very strongly opposed to ROM hacks.) But more likely it is the other way around. NCL would probably like NoA to go after such sites, but NoA is probably more reluctant to do so.
Nintendo of America certainly knows about sites like SMW Central, romhacking.net, etc. Those site do get ocassional visits from NoA ip addresses. NoA have to know they could most likely shut them down with a single threatening letter, especially since they are making no money (not even running ads). But they don't.
NoA seems actively reluctant to go after people who are not distributing raw roms (a.k.a. piracy), and are not making money, unless the project becomes really high profile (since it could cause marketplace confusion, trademark dilution, etc), or the project is likely to be confusing in light of something they are working on (See AM2R vs the 3DS remake).
All the nonsense they have pulled with Streamers and YouTubers stem in part from the fact that those people do make money from using Nintendo content. The stuff they have pull with tournaments stems at least in part from tounament sponsors finally benefitting from running them. Etc.