Suppose I need to check the logged in user is subscriber not anyone else. So if I check the capability like "read". Then subscriber is OK but "read" capability is also associated to admin/publisher as well. So checking only capabilities doesn't guarantee its subscriber only.
Second scenario, suppose I have made two custom roles like "vendor" and "distributor" both having same capabilities. So in this case to distinguish and provide security checking role is beneficial.
Is there any disadvantage or security issues with checking roles instead of checking capabilities?