You really ask 2 questions here:
What should be in the controller and at the business level?
=> I am inclined to think that the code in your first fragment is the correct level of responsibility for the service of the application level (and, therefore, for the Controller, if you acknowledge that these two options can be compared, which discusses a lot this time). Getting Order from the repository and saving it after the cancel operation is unlikely to be like pure business logic. This has more to do with the surrounding transactions / unit of work and the plumbing of your use case.
I would just change one thing: try to save the changes to all entities affected by your transaction at a time. If you need to manually update each entity that can be changed at the end of the action, this will be a big pain and will unnecessarily pollute the controllers. Create a working system unit (or use an existing implementation) that saves all changes at once and removes all Update () methods in your repositories.
In addition, as John suggests, I also think that a rich Order domain object containing the Cancel() method would be preferable to a service, but this is another discussion.
What should be the relationship between BLL and DAL?
=> BLL should not be tightly connected with DAL and as the most valuable layer, it should not directly refer to external layers. This way you can easily reuse your BLL in another application, with a different DAL, etc.
However, sometimes there are cases when some business objects need direct access to other objects to which they do not yet have a link, which basically means getting them from the database. In other words, some operations in BLL need to talk to repositories. Therefore, I always host repository interfaces in the BLL, but their implementations are in the DAL, and they are injected into the BLL at runtime.
As a result, BLL is only loosely coupled to DAL. It remains unchanged in the sense that it only manipulates facades (vaults) that look like neutral collections of objects and do not forget how data is stored, hydrated, etc.