Is this a fair assessment to say that Role only restricts data, while Profiles can be used to restrict most everything else, like UI, Object and field permissions, functional capabilities?
Roles : Roles control Records
OWD is the foundation which decides whether our data is setup in Private / Public Read Only or Public Read Write. This is the most restrictive data setting.
When the OWD is Private, Sharing Rules become available to open up the OWD data restrictions to groups of users or roles and subordinates. These can either be ownership based or criteria based(with some limitations)
Another way to share data is through Apex sharing where you can programmatically insert share records based on custom logic too complex to encapsulate as Criteria Based Sharing Rules.
Profiles control what you can do with the data that is visible to you, certain administrative permissions and of course which objects in the schema you have access to.
Field Level security for example lets you control at a Profile Level which fields are visible or read only to certain profiles.
The View All Data and Modify All data permissions on the Profile are exceptions because they bestow 'SuperCow Powers' on the users with that Profile. Hence why they are normally granted only to Full System Admins.
Permissions sets are a way to provision profile permissions in a modular fashion so you can group a bunch of related permissions. Permission sets supplement the permissions already granted to a user by virtue of their user profile.
Additionally Profiles also control which Apex Classes and Visualforce pages you have access to.
Profiles and Permission Sets are essentially the same container with only one key difference - a user may have one and only one profile but that same user may have 0, 1, or many permission sets.
Roles do not restrict anything they only grant you access. Think about a blank profile with nothing checked in object or UI things like API access or being able to email or run reports. You cannot do anything.
As you check more and more options and more and more objects and fields you can see and do more things so a profile gives you access to what you can do inside Salesforce.
The role with the role hierarchy is what you can see in Salesforce. Sure you can own a record and see it but what about the other people how can you see their records that they own? Based on your role and sharing settings it allows you to see more records.
There are no options in role or profile that restrict only allow. profile allows what you can do, role allows what you can see.