Yes, web app vulnerabilities are easier to discover. That's partly
because of horrible design decisions back in the 1990s, and partly
because we're dealing with greater diversity, more complex
interactions, and a much younger codebase. Plus, we had much less time
to develop systemic defenses.