Me personally, I believe that programming is way easier than ethical hacking. But the best penetration testers know a few programming languages. Web application testing has probably been the hardest for me so far in my journey. But it's my most favorite.