Happened to me...didn’t notice until I was reviewing charges (which I do not do near enough). Jerks.
My Roku credit card info is defunct and I never updated it for reasons like this
This is Roku’s fault. They do contracts with 3rd parties and then do not enforce adequate security.
Banks do this when they let your Visa/MC card purchases pass thru 3rd party data handlers that operate from our PC/phone to the online store, to the bank, etc. Wherever a 3rd party is involved is a point of insecurity. And, the banks don’t do a damned thing to protect you.
This is common. 3rd parties are typically involved to push risk away. TO YOU.