If history is anything to go by, the initial report is often the tip of the iceberg.
I wouldn't be surprised if they announce next month that oh, actually, all 80 million were compromised.
And then they'll come back a month later and say "oh, and another 500 million users, who don't have an account with us and didn't even know we were tracking them, yeah they were also compromised".
Of course, that doesn't happen every time, but it's pretty common. I wouldn't trust Roku to fully know what's going on yet. There's a good chance they are assuming it was credential stuffing but don't actually have proof of that. Hackers usually try to cover their tracks which makes any investigation difficult.
Um... that's a perfect example of why you need to avoid cultural references when use analogies.
When you said "like football" I thought you meant "any time you face a challenge, pass the ball to someone else". Where I come from, that's what "like football" means. And it's not necessarily a negative thing, maybe the new person with the ball won't struggle with the same challenge... and when they inevitably face a challenge of their own they might pass the ball back to you... with your original challenge now long gone.