I am unable to replicate this.
msg.message is correctly sent as the data object value.
msg.payload.message remains unaffected.
It is well documented that, should the input to the Call Service node have msg.payload.data as an object, then this object will be merged with the node UI data object config settings, and that matching input data fields take priority over the config fields.
Therefore, my assumption would be that you are indeed setting msg.payload.data to an object at some point prior to the Call Service node, whether by intention or as output from an earlier node.