Marketing sites and applications look similar in a design file and behave nothing alike in production. The distinction is not visual complexity. It is whether the system holds state that matters.
The first is accounts. As soon as users log in, there is authentication, session handling, password recovery, permissions and a real security surface. That is not a feature. It is a category change.
The second is relational data that users create. Records that reference each other, that have to remain consistent, and where an error is not a display problem but a wrong answer somebody acts on.
The third is workflow: states, transitions, approvals, notifications and audit. This is where most of the requirement lives and where most estimates go wrong, because a workflow described in a sentence takes a fortnight to build properly.
The fourth is anything with a compliance or financial consequence. Personal data at scale, payments, or records the business is required to retain. Those change the testing standard rather than the feature list.