Similar to what Google does with some Chromebook devices. They don't respect router DNS settings. So if I wanted to block YouTube on my kids machines I had to create a black hole on my router to send all requests from 8.8.8.8 and then and only then would the Chromebook use my adguard DNS.
The big issue is that they might start putting a checkpoint in place wherein the application (roku device) will not proceed unless it gets an expected response token from a call to an ad service. At that point we're at their mercy.
They could even run under their own VPN and hook up the ads on their side... Ugh...
They could even run under their own VPN and hook up the ads on their side... Ugh...
I've always wondered why Google doesn't provide that to its ad clients. Companies send their traffic to Google, Google puts the ads in, mixes it all up in one pot, sends it to the user in a way DNS filtering can't block without also blocking the content.
Or maybe at that point you'll begin to realize that you might not need all of this stuff, and that happyness comes from other sources. But that is just my personal approach, by all means do whatever you like.