Once the service represents the user's identity, it will check whether that user is authorized to perform a specific action and will deny access if the user does not have the required privileges. While authentication is required before any action is performed, authorization may depend on decisions that are made within the application logic. Therefore, authorization can never be responsibility of messaging or transport protocols but clearly belongs in the application domain and is consequently beyond the scope of the SOAP specification. By design, SOAP implementations can use the existing infrastructure of its underlying transport protocol. With basic authentication the username and password travel as clear text and are just weakly protected through a base64 encoding to make the fact not all too obvious.
Digest authentication is much better.
While it still carries all the risks of any password-based authentication scheme in being dependent on the quality of the password, at least it does not transmit the password over the wire. The latter is very important for SOAP services. Should password based schemes not be sufficient to authenticate the user, you can also rely on the transport. Most commercial web servers can be configured to reject all connections that do not come from clients authenticated based on client certificates before any services are called. The IBM Research Center in Tokyo has very recently brought up a very elegant proposal for a legal SOAP extension that is almost equivalent to the SSL client-certificate approach.