The fact your roommate thinks it funny to take over the system and wake you up during random hours is a reason in itself to lock him out of your network……… What else will he do? Abuse your NAS or printer? Steal files from your laptop? Why does he need this access?

I would guess that OP and roommate share the same internet access and router. NAS, printers, laptops can be secured, so it’s entirely possible that Sonos is the only issue.  And there may very well be some shared devices on the network, which makes getting your own separate router introducing some issues as well as an additional cost.

If your roommate can’t understand that the prank isn’t funny anymore, then either you demonstrate how pranks are not that funny with some pranks of your own (which could cause an unwanted escalation) or look into getting a new roommate.  I don’t think Sonos is going to start building out a security structure for basic operations at this point.