They’ve never been allowed, but people do it anyway because Blizzard cannot possibly monitor them all. There are a ton of these things running. There’s been private servers dating back to at least TBC. Maybe Vanilla? Not sure.
You yourself are not at risk of playing them, as long as you don’t stream it. Even then, you might be safe if you are relatively anonymous.