Roles in sys.user$

I'm hardening an 11.2.0.1 database and some of the checks are returning ROLE and USER where I would only expect to see USER.  One of these is sys.user$ which lists "spatial_csw_admin", type ROLE.

Unless something has changed dramatically since Oracle 10g, (a) roles aren't users; and (b) roles don't get assigned passwords.

The question of the moment is:  why are there roles in sys.user$?  And, just because the STIG check came back positive with roles:  are roles now associated with passwords (I don't think so, but maybe I'm missing a beat somewhere).

Thanks,

Mike