Web apps are not web sites. A site is an informative place (or "site"), publicly accessible on the internet, that provides info about your business, staff, locations, offers and so on. A web app is less public, if at all, and provides core functionality for the business processes of your company, amongst your staff and/or between your staff and clients. An unsecured web site may result in defaced pages and a bit of shame, because it is supposed the web site is not storing sensitive data, since its purpose is to make them public in the first place.
How about an insecure web app? Credit card numbers of your buyers, private data of your partners and contacts, sensitive inside documents, logins and PASSWORDS!, bank account data, trade secrets, the list of dreads keeps growing...