You can configure the search portlets for local operation, or you can configure them for remote search service. Depending on your configuration, remote search service might have performance benefits by offloading and balancing system load.
You can provide the remote search service either as an EJB or as a Web service via SOAP. With EJB you can have security enabled. With SOAP this is not possible.
When you want to index and search portal sites, search results are filtered according to the user security credentials. This filtering occurs independently of whether security is enabled on the remote search server or not. However, if security is not enabled, an unauthorized user can connect to the remote server and obtain unfiltered search results. If you want to prevent this, you need to use EJB and enable security on the remote server.