Is there a way to merge an ips file with a ROM and end up with one file to deal with instead of have two files named the same with different file extensions, or is that not legal?
TL;DR: distributing IPS files rather than ROM files (merged or otherwise) involves comparatively little legal risk. No one, or else almost no one, gets "busted" or sued for distributing patch files, whereas this clearly hasn't been the case for ROM files.
If you've a legal right to the ROM file, you've a legal right to the merged file, so that's fine to deal with on your own private machine.
The problem is distributing that ROM file - if you're distributing a ROM file (whether or not it's modified by an IPS), you're distributing it illegally (with a very few exceptions). This, too, is pretty much okay to do privately, as long as you understand and take responsibility for whatever legal, moral, ethical issues, and any potential consequences.
It is generally understood that distributing the patches on their own is not as legally encumbered as distributing a ROM file. The truth is probably that some patches are in more legal doubt than others (some large ones for instance almost certainly include portions of the original code), but even with these patches, the possible legal repercussions are believed to be low, since if you distribute a patch to a ROM instead of an actual ROM, you are not (directly) affecting any business's bottom line: that is, they still have to already possess the game's ROM file in the first place.
So yeah: basically it'd be a lot easier, at least for the consumers of patches, to pass ROM files around instead of patches. But by only agreeing to host or distribute patches, the website and/or patch authors do not assume unnecessary legal risk or liability.