Is there any security consideration with webform and Salesforce API? We are implementing the Salesforce webform module for our client and they are asking us if there are any security issues to consider by having SOAP installed on their server.

(The Salesforce API requires SOAP to be installed for drupal to communicate with it.)
PHP SOAP will not introduce any security issues in itself; it's more about how it is used. If it's used via unencrypted HTTP, for example, the data could be intercepted, like any other data. If you need the data to remain secure, then obviously this would be a consideration.