The YouTube mobile app and YouTube channel on roku together behave in a way that tries to be helpful but is insecure where there are lots of people in close proximity.
If YT mobile app can "see" a casting device nearby (Roku, Chromecast, maybe others) then it will prompt to login the YouTube app on the device. Most people will just OK that prompt, not understanding what it is doing or assuming it will connect to TV just in front of them (which in this case it does not, but people will just go huh and not think further).
AFAIK, it is only YouTube app which does this. (Would be kind-of helpful if some other apps like BBC which need a login did something like this in a secure way).
Not a Roku employee