They do, but I would argue that app sec is the responsibility of the development teams. Infosec can and should have a role in helping devs to follow good app sec practises, but having a seperate app sec team that don't have anything to do with app development seems unlikely to be the best model.