Is it advisable for a "real" application with tens of thousands of users to have both the application server and webserver on one machine?

For a large application with tens of thousands of users, is it typical for both the Application Server and the Web Server to be on the same machine? From what I know, all the Web Server adds is security by proxying to the Application Server which runs the web application. I feel like having a dedicated machine just for the Apache seems to be wasteful since there is nothing that I think would be done besides proxying to the application, unless there is something else I am missing?