web application – Does using Apache/nginx actually improve security of a webapp?

Just putting a simple load balancing reverse proxy in front of a broken web application does not fix it. It will implicitly some kind of sanitize HTTP requests at the protocol level, but it will not protect against any security issues at the web application level, like SQL injection, local file inclusion etc. It will also not protect against uploading malicious files.

Note though that are reverse proxies which can actually help. A Web Application Firewall (WAF) is usually a reverse proxy too. Common reverse proxies like nginx or Apache can be extended with functionality to filter traffic and even add WAF functionality. But this is functionality which needs to be explicitly added or configured.