The SPWebConfigModification class can be used for updating content web applications and also central administration. This can be applied to the SPWebApplication and also SPWebService classes. SPWebService derives from SPService, and has the WebConfigModifications property and the ApplyWebConfigModifications() method.
Is it possible, however, to register modifications to be applied to service applications? Service applications are reprented by classes that derive from SPIisWebServiceApplication, which derives from SPServiceApplication, i.e. is in a different branch of the class hierarchy derived from SPService and does not have the WebConfigModifications property.
For example if you need to make web.config modifications to the security token service (represented by the internal class SPSecurityTokenService, which derives from SPIisWebServiceApplication).
I considered a solution to deploy a replacement web.config into 14\WebServices\SecurityToken, but not sure if that is too messy (and you can't, for example, easily parametise the settings).