It's worse than that. If you don't add it, what's to stop someone else from adding it? A lot of them are just "press okay and it's added". There's no security and nothing to stop people from adding unclaimed applicances, except distance.

I vaguely remember a saying I read here once:

A tech lover has a home full of smart appliances and systems. A tech expert has a computer, a modem, a printer, and a revolver lying next to the printer in case it makes a sound they don't recognize.

Why would your Roku be any more or less safe than a TV? It's the exact same idea.

better than it connecting to one you don't own.