I can have address list filled dynamically by dns name resolution and use this list in firewall rules.
But currently I don’t have ability to limit ip service (such as winbox or ssh) to be available only to dns name – only to IP address/IP subnet.
So suppose I have a dynamic IP for place I want to connect to Mikrotik device from. I can make a firewall rule to allow this, but I can’t allow this in IP service list, so the only option is to allow this from everywhere – not the best choice, IMHO, from security point of view. Is it possible to add this ability in future releases?

Better you use a VPN (and close telnet)…
Can’t you do:
/ip/firewall/filter/add action=accept chain=input dst-port=8291 protocol=tcp src-address-list=your-address-list
?
I can. I will. Moreover, I have to (or it will not work at all if router has firewall rules enabled). But this MEANS I also need
to allow service from > everywhere – not the best choice, IMHO, from security point of view.
Better to have TWO points of check instead of ONLY ONE.