You are effectively downloading unknown software from some random strangers on the internet. Said random strangers can effectively, put anything they want into their program. Keep in mind that private server hosting is already in a grey area as far as the law is concerned. The law also depends on where the server is even hosted in the first place.
Even on RMS, people have made server listings before where the sites try to phish for peoples' information, let alone any downloads they may have hosted on said website. There was a Russian one impersonating OathRO less than a day after the server got "Oathkeeper'd".
Even if the program itself doesn't do anything, things like passwords, log-in information, emails, IPs, etc, are all stored somewhere, and if the admins wanted to, they could see those passwords and abuse that information. Then of course anything you say in-game is automatically logged as well, so if you talk about your personal life, tell someone in-game where you live, etc, that can be collected as well if the owner is nefarious and likes spying on peoples' chats.
Some servers however do not abuse that information, and sensitive information like passwords, while stored on the server, said server may be hosted via a third party and even encrypted, so even the owner cannot see what the passwords are.
Sometimes it's not the owners you need to fear, but the players. There have been a number of scams and attempts I've seen by now where a "player" will pretend to be a GM and get a player to download something, saying they're going to hire them and give them bitcoin or whatever, only to steal it from people and completely infect their computer. It's social engineering at that point and isn't necessarily a "Ragnarok Online" issue, but it unfortunately still happens.
Finally, even if a server begins legitimate, technically, nothing is stopping from the owner to patch in something nefarious into the game later that will try to do things to your computer. While I am not sure if it has happened in any private servers specifically, it has definitely happened for fan game projects, such as the infamous "Sonic Gather Battle" fan game which will outright close your web browser if you so much type in the word "cheat" and will send personal information to the owner via a blacklist. Or, even more recently, a Final Fantasy XIV filter mod was changed to shut off users' PCs because the owner was too narcissistic for their own good. While not stealing any personal information, most people don't like having their programs executing the shut down process without their consent.
