Yeah, I wonder how much weight that new arbitration agreement holds in light of this breach. I feel like you can't just fuck up with your customers' data, force them to agree to not sue you, and then tell them that you fucked up with their data. Those users agreed to a contract where they likely had critical information withheld from them in bad faith.
It probably wouldn't hold up in court, but it can be used as a bludgeon to dissuade people from filing in the first place. Roku is totally allowed to lie and say "You can't sue, you agreed to mandatory arbitration. // You can't join the class action, you agreed not to. If you do either of these things, we'll sue you."
This could easily dissuade quite a few people from litigating, limiting how much the company needs to pay out.
Note that the bit about arbitration or not filing class action suits is not new. The new bit was having to talk to their lawyers even before requesting arbitration.
But in any case, I doubt those would be held enforceable in the event of something like this.