Why a lost remote is not a lockout
The physical remote and a phone reach the Roku by completely different roads. The remote either shines infrared at the device or holds its own wireless link to it. A phone sends the command across your home network to the device's address. Neither road depends on the other, so a remote that has vanished, broken or run flat takes nothing away from the network route.
This is also why there is no pairing code to recover. Some remotes have to be paired to a player; the network path has no equivalent step. The app finds the device, you tap it, and every key works. Nothing about the missing remote was ever holding a credential the app would need.