Right. This security concern should be implemented at the web service level. You should easily restrict the web service to use WS-Security, user authentication, or some network restriction like a application server whitelist to include your authorized users.
SoapUI can then be used to test and send in authentication if need be, but as a tool itself, it doesn't implement security on your web service for you. Even without SoapUI, people can still access your web service with curl scripts and other methods while your web service is unsecured.
Thanks,
Michael Giller
SmartBear Software