This type of hack is called a credential stuffing attack, and it's not Roku's fault ... and some that are free, like Bitwarden or Apple's iCloud KeyChain.