As a security consultant, I disagree. There is quite a clear trend in what kind of vulnerabilities web applications have. XSS is getting slightly better but still has a way to go, CSRF has much more awareness and went from "rarely prevented" to "usually prevented", SSRF is getting more common due to new kinds of architectures (more back-ends talking to each other), but SQL injections are, well, not quite a solved problem, but vastly better than it was ten years ago.
I think this can be attributed largely to better libraries that make the secure way the default (such as parameterized queries) and somewhat to more awareness (tutorials and examples will mention things like escaping variables). Perhaps people also hear more about it in school nowadays, but I don't think schools changed much.
My view of the world is somewhat tainted since companies pay me to find their bugs (they are serious about security), but I also am a normal user of random websites like everyone else. Some websites smell, and I'll investigate and sometimes find vulnerabilities. And I hear what is going on in the field, what leaks have happened, what bugs people are finding. I try not to let my paid work taint my view too much.