That doesn’t have anything to do with it, really. There’s plenty of ways that credentials get “leaked,” not the least of which is users who reuse passwords also falling for scam emails that have them “log in” to something. It could matter if some specific credentials were initially acquired because some other place was storing clear text passwords, and that place had a breach.

Still wouldn’t be an issue at all if users didn’t reuse passwords. That’s the lynchpin. This is users’ fault, not Roku’s.