I feel 23andMe's feet deserved to be held to the fire over a credential stuffing attack, not just because of the sensitivity of the data, but because of how the

I feel 23andMe's feet deserved to be held to the fire over a credential stuffing attack, not just because of the sensitivity of the data, but because of how they allowed accounts using insecure authentication methods to access data from other accounts. Roku though? The data stored in a Roku account is not totally insensitive, but it's not seriously sensitive. A lax security posture is justifiable. I would personally not care a bit if somebody infiltrated my Roku account and I don't believe most people would. The accounts mostly exist for Roku's purposes more than their customers. My only concern might be people using my account to authorise charges I did not approve to rent movies, but I don't see why anybody would actually want to do that, since it's a lot more cumbersome than piracy.