For a web application, an acceptable solution for secure communication
is HTTPS (tranport level). However, in large companies, the web
application is behind a reverse-proxy/load-balancer (and a web
application firewall on top of it). The reverse-proxy is able to
decrypt the communication, and we expect it to decrypt the
communication so as to analyse the traffic. Then it sends it to the
web application in the private lan (sometimes in plain HTTP).
Although sometimes it is necessary to decrypt the traffic on the reverse proxy to perform deep packet inspection (e.g., with WAF), it is a good practice to encrypt it again before forwarding the request to the destination server (even within LAN) – so that no one can see or modify it in the process. Ideally, packets should never be sent in clear text, even within LAN. (see https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)
For secure SOAP web service, HTTPS can be used, but as explained in
http://msdn.microsoft.com/en-us/library/ms977358.aspx, XML encryption
(message level) is promoted so as to prevent intermediary points, such
as the SOAP message router, to have access to the message. Then the
SOAP message is sent (still encrypted) to the right service provider
in the private lan (only then the message can be decrypted).
These days, it is very rare for applications to encrypt the XML message itself. Instead, they are occasionally signed to prove their integrity (see: https://www.w3.org/TR/xmldsig-core2/) and are transmitted over SSL/TLS connection for confidentiality. In case of apps and services handling very sensitive data, you might also want the communication to be performed in a way that both parties authenticate themselves to each other (mTLS) for additional security.
As a general rule, it is critical to avoid creating any cryptographic algorithms yourself but instead rely on the ones defined in the RFCs and considered secure as of writing the application or service. Luckily, most modern frameworks make use of those safe algorithms within built-in functions, so it's usually more secure to use them instead of coding anything from scratch. Also, regardless of the exact technology we are using for services, it is very important to remember about security of the API itself (see: https://owasp.org/www-project-api-security/)
So to answer the question – there is usually not a big difference between an application and service in terms of security except when we are dealing with very sensitive data. In such cases, some additional measures, i.e., mTLS or message signing, can be employed.