Are you getting charged by "Roku for CBS" or directly? It's quite easy to establish an account through Roku AND directly on the Paramount site and get charged for both. It's also possible to have accounts through Amazon and others and they all happily charge you without having a clue about the other accounts.
The item on my card statement states Roku for CBS. Couldn’t be any clearer
When a financial institution gets credit card data submitted to them, there is a description that is essentially free text. It can say anything.
It's supposed to say who made the charge, and contact information about it. However, it can contain any information.
If a thief (no other way to describe them) obtains credit card information, they can submit the information and fill out the text any way they want. They can put NASA, they can put Queen of England, they can put UNICEF, they can put Roku, they can put anything ... heck, they could put your name. In this case, they put Roku. They're thieves, so a lie on top of theft is kinda par for the course.
What may have happened is that someone compromised a system that had that your credit card information, and some thief (maybe the same person, maybe a different person) ended up with it. They submitted information and put Roku in the description.
If the Website shows it canceled, and you were billed anyway, it's likely that Roku didn't do this. Some thief did and then lied about it. But it's proper to pursue with Roku, since a subscription did exist.