At first sight they do indeed exactly the same.

I think it has something to do with how you implement your security model.

Are you giving everyone access first and then deny access to specific resources?

Or do you deny access first to everyone and then give specific access to some resources?

Those are two different ways of implementing security, so it seems logic to me that there are two different roles.