The Roku, Inc. data breach exposed usernames, passwords, and account login details, potentially affecting individual Roku accounts. No highly sensitive personal information was accessed. Roku has taken immediate action to secure affected accounts and refund unauthorized charges.
I wonder if that will hold up in court for existing customers affected prior to the updated TOS.
Unlikely.
Note that the bit about arbitration or not filing class action suits is not new. The new bit was having to talk to their lawyers even before requesting arbitration.
But in any case, I doubt those would be held enforceable in the event of something like this.