What is more secure checking capabilities of user or checking role of user in WordPress plugin development

I would always go for the role “check”.
As in your case:

if ( current_user_can( 'vendor' ) ) {
    // do stuff
}

Or of course the distributor role as created by you.

This way you can be sure that one is not interfering with the other and you can assign each role to its own “task” (e.g. allowing to edit only a specific custom post type or even his/her own meta-box) even though the capabilities are equal.
About possible security risks I can not judge, that depends all on the capabilities you have add to those roles.
Selecting by rolegives you imho more freedom and has no negative effect as far as I know.

The only thing you have to be aware of is that you have to be consequent in dividing tasks/allowing access when they are for a specific role.

No idea if this is an answer which helps you out, maybe some of the other users here can/will inform you better than I do. This what I wrote is seen from my perspective, so be my guest.