ROM = Read Only Memory
The internal memory of the device is split into (simplified version) a /system partition and a /data partition.
Android is installed on the /system partition. The /system is read only. So when Someone talks about ROMS (in relation to an Android device), they are talking about Android.
When someone says "update your ROM' they mean "update your android".
A Normal user can change their ROM to a completely new one without any special permissions. For example, the international GSM S3 was updated to jellybean but only in Poland. People in other countries with the same model (gt-i9300) have been able to take that ROM and install it.
The /data partition is read / write. This is where your apps install and you sms database is held (amongst other things)?
root = superuser. In Linux terms, a computer user that has administrator permissions is called a root user. This is because a root user has access to the very highest level of the file system, which is called the root.
For example, in windows, typically you would use c:\users\david. The root of this path would be c:\
In Linux, you wouldn't have access to the equivalent root area without being the root user.
Hope this makes sense so far.
In Android (which has a Linux based kernel) the same is true. To get read / write access to say /system (which we talked about earlier) for example, you would need root access.
Unlike Linux where the root user has a username and password, with android you only have one user so a process must be followed to give that default user root access.
So in conclusion, ROM and root are not the same thing at all.
Hope this helps