No piece of software that you install on any hardware of any form is 100% safe unless you are the author or you've read all of the source code, verified its safety, and built it yourself. Okay, so this may be something of an oversimplification, but it's actually not too far off in most cases.
Custom ROMs are no exception to this. Yes, a ROM author could put spyware, a backdoor, or just about anything else they wanted into a ROM if they wanted to maliciously exploit it. With AOSP ROMs I suppose the possibilities are somewhat magnified since the Android source itself could be modified to contain some kind of exploit or spyware.
It's also worth noting, however, that running a manufacturer stock ROM isn't necessarily a safer option if you're concerned about privacy.
The question "is Android safe by default" is in some ways kind of a meaningless question. Is it designed to be safe? Well yes, data is protected at the application level and apps are sandboxed. Any OS is intended to be safe, but all of that goes out the window when you run a ROM that's not pure AOSP. On top of that, the nature of code is that it has bugs, with Android being no exception. Custom ROMs and manufacturer ROMs alike can absolutely have the potential to introduce (either intentionally or unintentionally) ways for your data to be sniffed or stolen.
