What is more secure checking capabilities of user or checking role of user in WordPress plugin development

Question

Suppose I need to check the logged in user is subscriber not anyone else. So if I check the capability like "read". Then subscriber is OK but "read" capability is also associated to admin/publisher as well. So checking only capabilities doesn't guarantee its subscriber only.

Second scenario, suppose I have made two custom roles like "vendor" and "distributor" both having same capabilities. So in this case to distinguish and provide security checking role is beneficial.

Is there any disadvantage or security issues with checking roles instead of checking capabilities?

Answer 1

I would always go for the role "check".
As in your case:

if ( current_user_can( 'vendor' ) ) {
    // do stuff
}

Or of course the distributor role as created by you.

This way you can be sure that one is not interfering with the other and you can assign each role to its own "task" (e.g. allowing to edit only a specific custom post type or even his/her own meta-box) even though the capabilities are equal.
About possible security risks I can not judge, that depends all on the capabilities you have add to those roles. Selecting by rolegives you imho more freedom and has no negative effect as far as I know.

The only thing you have to be aware of is that you have to be consequent in dividing tasks/allowing access when they are for a specific role.

No idea if this is an answer which helps you out, maybe some of the other users here can/will inform you better than I do. This what I wrote is seen from my perspective, so be my guest.