Last night I was watching a movie through Amazon Prime, and right at the same time, Roku sent me an email saying congratulations on the new subscpiption for Showtime + Starz Value Pack through Roku! I use a Roku device to access Sling, Amazon Prime, and Netflix. Any movie charges would go through those respective services, if that's where I'm watching the movie. Not the Roku device. Besdies, I have a PIN set up as an additional requirement for any purchases through Roku.
If I did not see this Roku email (if it got dumped in a spam folder), I would have been charged $16.99 in 7 days of the email. I cancelled the errant subscription the next day, and called Roku to understand how this happened. The CSR had no idea and no explanation as to how this happened, which tells me the root cause has not been fixed, and it is entirely possible this kind of thing could simply continue to occur.