I do this with a single device here. I want normal blocking for everything else on the network, but for that device I want it to have no blocks.
In Groups I created a group called Unrestricted and in Clients I located the device and added it, then edited its group so it is only in Unrestricted. Since that group has no adlists or domains attached to it there is no need to whitelist anything. Now, for this device only, all DNS requests are passed upstream and nothing is blocked.
If Pi-hole is passing everything from the Roku upstream, essentially it's like Pi-hole isn't there. Perhaps your router or ISP is messing with it, or had network problems which coincided with your testing.
You can be absolutely sure your group setup is not the cause by trying Disable Blocking > Indefinitely. This will pause blocking for the whole network. When you're done testing, use Enable Blocking to return to normal.