This is true because of the availability of targets, however, the easiest place to get your feet wet is not the same thing as the easiest discipline and people must keep that in mind. Application security is the toughest of the discipline's in my book; far tougher than netsec, oppsec, and many others because it's a world of vast diversity of solutions. It's also a world of vast diversity in attacks from SQLi to XSS, to remote unauthenticated remote code execution, to the identification of logic errors which result in the exposure of sensitive information.