Over the years, people dumped all their cartridges and illegally uploaded them to the Internet.
Someone else made a program to catalog all known ROMs.
Someone else used that program to collect every known ROM and shove them into one big zip file.
Some ROM site guy downloaded that big zip file and split it into individual ROM zip files and uploaded them to their site.
There's a number of devices to rip almost any SNES cartridge to a ROM file easily. It's only legal as long as it is used for backup purposes: you don't give the ROM to anyone else, and you delete the ROM if you sell/give away the cart.