Should I log the user out after calling an API using the Services module?
If you log the user out, the session ID that you received and used to modify users will expire, so it's recommended to do so.

I can imagine the following scenario: 

You leave the user logged in. Someone else who have access to the server that you used to do the aforementioned actions somehow figures out the recently used session ID. They can use it to log in to your Drupal site within the maximum session lifetime.