I don't think it's fair to blame the skill of web developers (although if they use javascript and leftpaddings they have it coming).

The nature of web software is 100 times riskier than anything else because of the risk profiles and 100% connectivity