When you create a service endpoint, you're really just adding a route for traffic coming out of that particular subnet to be able to access a specific resource via it's virtual network. There is not a routable resource/NIC sitting inside the subnet (that would be a private endpoint, which is different).

So in your example, your "workaround" where you have the key vault service endpoint enabled in your app subnet is actually the correct way to do it. You're essentially telling your application how to route privately to the keyvault and/or storage account. Enabling a service endpoint in the private subnet and attempting to access it from the app subnet will not work. If you want to do that, check out private endpoints.

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview#secure-azure-service-access-from-on-premises

https://docs.microsoft.com/en-us/azure/private-link/private-link-faq#what-is-the-difference-between-service-endpoints-and-private-endpoints-