Several possibilities come to mind:
1) Roku was compromised prior to purchase, have device details, allowing access/onscreen messages
2) Roku was activated through scam/fraud site/service, have device details, allowing access/onscreen messages.
3) Parents WiFi/Home Network has no/weak password and/or is compromised, allowing access/onscreen messages.
4) Screen sharing was used by someone nearby, doesnt require network access, allowing onscreen messages.
Roku devices (and other streamers/CE, to be fair) have little to no (and broken) device security, so once someone has access to the network all sorts of mischief and shenanigans can be had. WiFi Direct functionality allows non-network access, making it even easier.
They should check/change their WiFi password(s), and disable any screen sharing/Miracast/WiFi Direct functionality and limit network access (somewhat broken):
Settings/System/Screen mirroring/Screen mirroring mode=Never allow
Settings/System/Advanced system settings/Control by mobile apps/Network access=Disabled
Settings/System/Advanced system settings/Device connect=Disabled (only works with non-stick models using IR-only remotes/unpaired remotes in IR mode)