1. no, since a CI may provide multiple services. e.g. if you have a server it may provide both file and printing services, which may have different SLAs. Service Desk will always choose the stricter SLA to determine the deadline.
The approach that we (Fox IT) have taken with this is that the service is typically what the customer says they cannot do. So for example if you have a service called FRED which some of your customers receive via an SLA, when the call they typically say "I can't use FRED". So at initial logging you put it down as FRED because that is the business service that is affected. this then give syou the service level and hence the business impact. (Note that if you do choose a servce and hence servic elevel here, you will get the default service level).
During the lifecycle of the call, investigation may show that it is in fact the network which is at fault. We recommned that you record this fact in the CI so that on closing the call you have the information as to what was actually wrong (the CI) but also what business service was impacted (FRED).
You ask: "Can I assume then that most business facing applications are created as Services".
I can only answer that in most implementations where we have been involved that has been the case because that has been the approach adopted when setting up the Service Catalogue.
This does not mean it is the only way of setting up services but in my experience if you need to be able to specify which service is affected when someone logs a call it is very difficult to do this unless you do take this approach. You can of course set up a hierarchy of services with this kind at the lowest level but I would recommend experimenting to see what suits you.