Since #1 supports Tomcat why would one want to use #2?
spring-boot-starter-web contains spring-boot-starter-tomcat. spring-boot-starter-tomcat could potentially be used on its own if spring mvc isn’t needed (contained in spring-boot-starter-web).
Here is the dependency hierarchy of spring-boot-starter-web:

What are the differences?
spring-boot-starter-web contains spring web dependencies (including spring-boot-starter-tomcat):
spring-boot-starter
jackson
spring-core
spring-mvc
spring-boot-starter-tomcat
spring-boot-starter-tomcat contains everything related to an embdedded tomcat server:
core
el
logging
websocket
What if you want to use spring mvc without the embedded tomcat server?
Just exclude it from the dependency:
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
<exclusions>
<exclusion>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-tomcat</artifactId>
</exclusion>
</exclusions>
</dependency>