The Roku, Inc. data breach exposed usernames, passwords, and account login details, potentially affecting individual Roku accounts. No highly sensitive personal information was accessed. Roku has taken immediate action to secure affected accounts and refund unauthorized charges.
It probably wouldn’t hold up in court, but it can be used as a bludgeon to dissuade people from filing in the first place. Roku is totally allowed to lie and say “You can’t sue, you agreed to mandatory arbitration. // You can’t join the class action, you agreed not to. If you do either of these things, we’ll sue you.”
This could easily dissuade quite a few people from litigating, limiting how much the company needs to pay out.