They are all basically the same thing to the fact that they are just wrappers for the Odoo internal API, but these wrappers are slightly different in how the protocols work:

/xmlrpc is for RPC calls where the POST body must be XML; credentials are part of the POST

/jsonrpc is for RPC calls where the POST body must be JSON; credentials are part of the POST

/web/dataset is for RPC calls where the POST body must be JSON and is basically the same as /jsonrpc except that the TOKENIZED credentials are passed in the session_id cookie; this makes it the proper API to use in a web based application, provided that its running under the exact same host-name, so that you don't have CORS headaches. In this scenario, you typically have a reverse proxy running your web app under some specific path on the server. For example odoo.example.com/odoo might serve your standard Odoo deployment, but odoo.example.com/vuejs might serve your Single Page Application. Since they are both under "odoo.example.com" ... no CORS preflight checks are made.

Both /xmlrpc and /jsonrpc are ideal for code that will NOT run in the browser regardless of the programming language used, but I recommend JSON-RPC since its much lighter than XML. So for example, if you are writing Python scripts for ETL purposes, then you should use the JSON-RPC API.

There is some other nuance with /web/dataset vs the other 2. If you need consulting, please feel free to email me: mike at idaz dot co (not .com)