When a financial institution get credit card data submitted to them, there is a description that is essentially free text. It can say anything.
It's supposed to say who made the charge, and contact information about it. However, it can contain any information.
If a thief (no other way to describe them) obtains credit card information, they can submit the information and fill out the text any way they want. They can put NASA, they can put Queen of England, they can put UNICEF, they can put Roku, they can put anything. In this case, they put Roku. They're thieves, so a lie on top of theft is kinda par for the course.
Someone compromised a system that had that credit card information, and some thief (maybe a different person) ended up with it. They submitted information and put Roku in the description.
Roku didn't do this. Some thief did and then lied about it.