Let's check documentation

;domain=domain (e.g., 'example.com' or 'subdomain.example.com'). If not specified, this defaults to the host portion of the current document location. Contrary to earlier specifications, leading dots in domain names are ignored, but browsers may decline to set the cookie containing such dots. If a domain is specified, subdomains are always included.

Note: The domain must match the domain of the JavaScript origin. Setting cookies to foreign domains will be silently ignored.

Your first cookie with domain www.roblox.com will be accessible only at www.roblox.com/... page but .roblox.com's cookie may be accessed by JS from all roblox.com subdomains.

Here is a good answer

So as @smac89 wrote in comment, You should add domain when create new cookie

document.cookie = ".ROBLOSECURITY=cookie; expires=session; path=/; domain=.roblox.com"

There is no syntax for what you want.

You can either not set the expiration value, the cookie will expire at the end of the session, or choose an arbitrarily large value.

Be aware that some browsers have problems with dates past 2038 (when the Unix epoch time exceeds a 32-bit integer).

See : https://stackoverflow.com/a/532660/1901857