If there is no opt out I have a slightly used Roku for sale.

There's a reason I have my Roku on an Adguard network

I run PiHole on my home network, but it's not my default DNS server (for technical and other reasons); I have to configure custom DNS. I'm disappointed that I can't do that with my Roku devices.

I have a specific appliance network, designed exactly for this. My computers don't live on that network, but things that I demand not spy on me lives there.

Adguard is basically the same as Pihole. They run the same way, and are both FLOSS.

But Adguard runs right on my router.

DHCP can certainly do that for you. Set up a reservation, and assign that MAC a specific DNS server.

I'm pretty sure all these devices or apps on those devices configure their own DNS servers these days.

Not necessarily, I've had good luck with DNS blocking my Roku at least. I was surprised since I expected it to have hardcoded DNS. I'm sure that Chromecasts are propbably hardcoded to 8.8.8.8. It's probably not possible or easy to do with a consumer router, but if you had a Linux router (or something enterprise-y), you could do a NAT rule similar to this to force something to go to your own DNS server:

    iptables -A PREROUTING -s <IP of device> -d 8.8.8.8 -p udp -m udp --dport 53 -j DNAT --to-destination <IP of custom DNS>:53

I hope the NextDNS privacy blocklist for Roku can deal with these.

Good reminder for as much attention some of HN crowd gives to Google being teh ultimate evil, that pretty much every other data handler (ISPs, cable boxes, smart TVs, mobile network operators, etc.) is far worse.

I think it is more reasonable to assume most executives have similar incentives and mindsets so all companies are as "evil" as they can with all the data they have if they believe they can get away with it.