I'm always a fan of doing what interests you and figuring that you'll find something new or a next good step for yourself along the way - so my return question is "does this interest you?"
You're right that the field is pretty well covered - there's several good products out there for static source code analysis and I think there are likely others for binaries. I'm not sure that the analysis products cover all scenarios that are documented by OWASP, though. In particular, I'm vaguely remembering some good security practices that are exceedingly hard to verify with the currently available techniques. And I don't know how much has been done on some of the harder to link cases - like JEE with dependancy injection.
I think there's a lot of work going on in software security, but I wouldn't call it "saturated". I think the surface area of the software security arena is growing by leaps and bounds as software and mobile code have been permeating our lives in the last 10 years. So while the number of people working in this feild is growing exponetially, the number of problems to solve in this field is growing faster.
That said, the other return question I have is "what do you want to do next?" PhD's are not a win in every development company - lots of people in the world of security came up through on the job experience, and don't have a lot of respect for academia. If you were looking for the degree to shotput you into a senior position in a major company, you may want to browse around the job space and see what you find.