One more thing. (Sorry) - ROKU controls the channels on the Roku Box Account. All Roku boxes on the same account show the same channels installed for that account. You can go through and remove channels from individual boxes on the same account and eventually they refresh themselves to all have the same stuff on each one - I'm not sure if this is caused by a reset of the box in question, or if it happens during an update to the system, or what, but I've seen it happen before. By 'controls the channels' what I mean is, roku tracks which channels the user has installed, makes sure they are patched to the latest version stored on ROKU's servers for the channel store, basically maintains them, does billing for a few of them where required, and keeps them organized, possibly tracks their display order, etc etc.
The individual channels themselves have their own billing systems and authentication systems on their individual servers - except for the few channels which are billed by ROKU. So, it's possible, without a factory reset, for someone to 'borrow' someone else's paid subscriptions on a roku device and use it at an alternate location provided the registry key exists which is used for the authentication.
So, I guess my real underlying question is - you need to use the serial number as it is to link a box - I just do not see any way around that requirement - it is already unique. How would you go about checking for a factory reset by the end user - which clears all information used for authentication - to automatically unsubscribe them from whatever billing system you are using if that was the only device on their account without accessing the serial number? Could a factory reset be designed to send out a notification method to all the installed channels, and could such notification also be added to the channel removal code on the roku device so that when a channel is uninstalled, all recurring payments would know to stop? Does the ROKU billing service do that?