Roku OS does not use MiniUPnP open source library, and never has, to the best of my verification.
The nominal version numbers on the External Control HTTP response header is just a bit of fixed text.
I suspect that label was either blindly copying what someone observed from network snooping, back in ancient days, or it might have been used for compatibility with some particular 3rd party (again in ancient days).
I'll file a ticket to have that removed.
If you have additional questions about the open source compliance, https://www.roku.com/separatelylicensedcode lists a contact email as well.
