Web applications are made up of a vast array of flexible components, where some of them exist no matter if you use them or not, and others can be chosen.
Real, or Existant Components:
You can choose whether or not to be aware or not of some of these components, and some of them are useable in some cases, and not useable in others. For example you do not want to use activex when you know that the majority of your target browsers is not IE.
Looking at the vast array of technologies that make up the Web in 2004, its not surprising in the least that it is a VERY complex environment, where most people cannot begin to create interesting or useful applications.
Think about it. You have to know video editing, graphic design, javascript programming, flash actionscript and animation techniques, as well as backend server programming like cgi'z, or apache modules like mod_python, and sql to talk to relational databases. At least if you want to make a killer webapp.
There is also the multitude of escaping of characters, url escaping, php escaping, mysql escaping. Security in this kind of environment is hard, and its easy to get cracked.
On another note, yet of course related in intricate yet outstanding ways, something much worth visiting.