I do UI design/dev and say "surface up" a lot. Although I don't use the term, in this area people call different container depths as surfaces (base, card, overlay as surface).

Attack surface is another one I use.

Yes, I've always heard it used in this context. I really believe the other use is because someone misheard "service", and it stuck.

That's rather funny! Probably true. "API surface" sounds exactly like a CEO trying to say "API service" without understanding what an API is. lol.