It seems that annotation WebConfig takes precedence over jboss-webservices.xml descriptor values. It doesn't seem right as you cannot override annotation values for test purposes for example.

Problematic code seems to be:
org.jboss.as.webservices.metadata.AbstractMetaDataBuilderEJB:159
(should prefer JBossPortComponentMetaData over EJBEndpoint)

and

org.jboss.ws.common.deployment.EndpointAddressDeploymentAspect:177
(should prefer EJBSecurityMetaData over annotation value)