A custom role decoder may have provided a custom Roles implementation that lazily loads roles as required or even send off all contains requests to a remote service. Additional contains methods will allow those two to be optimised.

Default implementations should just iteratively call contains which is what any external caller would have to do at this point anyway.