The accounts were "hacked" when attackers found usernames and passwords leaked from unrelated sites that also worked on Roku because the account owners used the same password everywhere.