It's definitely not intended that beginners can easily finish, but we hope that everyone can get something out of it. We were actually fairly happy with the conversion rate from start to finish last time. If everybody finishes, it presumably means the later levels weren't hard or interesting enough.

We hope that people new to web security can solve the first few levels with some work and inspection, and the later levels with hints from others or a significant amount of research into the topics.

At the end of the day, the point of the exercise is to expose realistic vulnerabilities for fun and education. We try to make them similar to how they'd be in the wild.