This seems to be “how Roku does things” in a way that Plex has no control over and has to go with to have a presence on the Roku app ecosystem. I asked about this a few months back and also found it kinda concerning. Looking back at my post then I noticed that I was unable to actually remove the Roku auth at all. I removed the Roku from my Authorized devices screen at the time, yet didn’t have to sign in on the new Roku. Even if the “Roku Auth” is for the whole Roku Account it should have been deauthorized then.
At least with the recent security breach and password reset I can confirm that did remove the auth then, as I had to reauthorize the device this time.
