Since T222388 it has been possible to inject services into API modules and special pages.
Some SpecialPages in core now do this: https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/58b7003abb72d4c042164ad7e2262c6a8e4f0f9a/includes/specialpage/SpecialPageFactory.php#69
API modules in core don't seem to do it yet: https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/58b7003abb72d4c042164ad7e2262c6a8e4f0f9a/includes/api/ApiMain.php#61
SpecialPage and ApiBase access the service container directly.
There are discussions happening in code reviews on individual patches about whether (or when) we should be injecting services in core API modules and special pages. It would be good to have some guidance so we can resolve these conversations consistently.