I entered my credit card info so I could start using Disney+. My card was then robbed and Thousands of dollars was attempted on my account. I canceled that card. Sometime later Disney+ said that they could not bill me. I set up on my TV the new Card info. Less than a week later, someone grabbed my card info, also living in California, and tried to charge several things. I guess it could be Disney+ where the number is being jeopardized. I only worked through the ROKU account though. Check your people something is very wrong.
Is the password on your Credit Card online account the same as any other account you use? Many people re-use passwords; that is, use the same password for multiple accounts. Never never never do that. If any one of those is compromised, they are all potentially compromised.
Also, ensure you have reputable malware prevention software (Antivirus, etc) on your device.
Malware can scan your computer for information, to include keyloggers, and report those back.
Use your router's software to ensure you are familiar with all the devices that connect to your network. A device sitting on your network can monitor traffic and report back.
The bottom line is there are several ways credit card information can be stolen. My understanding is that Roku doesn't store the data unencrypted. That is, a person can't read the data. It's much more likely that your network, your computer, or one of your online accounts sharing a password with your credit card company was compromised. That's not to say it couldn't happen, just not likely.
DBDukes https://www.dbdukes.com/Roku Ultra (4660) Roku Streambar (9102) Roku Streaming Stick+ (3810)