Suppose the client application wants to find the IP address of “web.example.com.” How does it know which name server to query?

The answer is it doesn't. The client has no idea that NS3 or any other name server has any information about web.example.com. Well, the client application can just somehow obtain a copy of the entire namespace, which is quite small, but imagine this namespace having billions of nodes and getting updated and changed every second. Not only that, the namespace is spread across different servers so compiling a copy of the whole tree would require querying a server for every zone. A client maintaining its own copy of the entire structure is just not feasible.