Code security is the approach of using permissions and permission sets for a given code to run. The admin, for example, can disable running executables off the INTERNET or restrict access to corporate database to only few applications. Role-based security most of the time INVOLVES the code running with the privileges of the current user. This way the code cannot supposedly do more harm than mess up a single user account.

There's no BETTER, or 100% thumbs-up approach, DEPENDING on the nature of deployment, both code-based and role-based security could be implemented to an EXTENT.

Code security is the approach of using permissions and permission sets for a given code to run. The admin, for example, can disable running executables off the Internet or restrict access to corporate database to only few applications. Role-based security most of the time involves the code running with the privileges of the current user. This way the code cannot supposedly do more harm than mess up a single user account.

There's no better, or 100% thumbs-up approach, depending on the nature of deployment, both code-based and role-based security could be implemented to an extent.