It's read-only in the normal functioning of the device. Nothing gets written to ROM when you're using the phone. Almost nothing very complicated uses hard-coded ROMs any more; even wireless routers and cable modems use flashable firmware these days.
In most phones it’s not even a special EEPROM, it’s effectively your system hard disk where you store your photos and contacts, that’s just protected from user writes in system areas. It’s really not much different in concept than an SSD notebook where you haven’t been given admin privileges. This is why you have to “root” an Android device before flashing it.
I just found it amusing how old-time terms stick with us even though they’re not applicable anymore.