As per below link,security for Office Add-ins and what I understood that we need to apply SSL for Add-in and XYZ WEBAPP which we are expecting to get loaded inside the office 365 add-in task pane.
But, do next level WEBAPI calls also need to be secured (Https) which needed for XYZ application?
The answer is yes, per documentation you refer to ... "Data communicated with the web server that hosts a content, Outlook or task pane add-in as well as communication between the add-in and any web services it uses must be encrypted using the Secure Socket Layer (SSL) protocol."