Without defaultdict, the loop body would be if role not in by_role: by_role[role] = [], then by_role[role].append(...). defaultdict(list) collapses that into one line: any read of a missing key auto-creates an empty list and inserts it. The defaultdict constructor takes a factory (here list), called with no arguments to produce the default. Wrap the result in dict() for printing if you want a clean output, since the repr of a defaultdict shows the factory.

defaultdict(int) initialises missing keys to 0, which makes counts[key] += 1 a one-liner instead of a if key in counts else 0 dance. For pure counting, Counter is even more idiomatic and supports most_common, but defaultdict(int) is the right answer when the count is mixed with other per-key state (sums, running averages). The choice between the two usually comes down to whether you want extra Counter-specific methods or a more general 'every-key-has-a-default' shape.

When the natural shape is a nested mapping (user -> action -> count), wrapping the inner dict in another defaultdict keeps the nested loop body just as terse as the flat case. The lambda: defaultdict(int) is the factory: each new outer key gets a fresh inner defaultdict(int). Watch out for serialisation: a nested defaultdict still answers __getitem__ on missing keys when you read it later, which can mutate it during a JSON dump. Convert to a plain dict with the comprehension above before serialising to be safe.