While many legacy ROM sites have been taken down, several reliable communities and archives still host these files.
Always remember that the most "legal" way to get ROMs is to dump them yourself from cartridges you actually own using a 3DS with Custom Firmware (GodMode9). Most of the sites listed above operate in a legal gray area, so always use a VPN and browse safely!
Finding decrypted 3DS ROMs (often referred to as .3ds files for use in emulators like Citra) can be a bit of a maze because of copyright laws and the constant shifting of the emulation scene.
It offers direct downloads without intrusive ads or "download managers."
Here is everything you need to know about finding and using decrypted 3DS ROMs. What are Decrypted 3DS ROMs?