Is it weird that I find people who work in cybersecurity risk management as "fake" cybersecurity people?

So I've been doing some technology cyber risk assessing for over a year and a half now and wanted to say what I've noticed. It seems like i'm doing risk management/assesment of compiling evidence and then fixing an audit for it. However, I feel like this type of work is so mundane and so easy that the people around me know nothing more than the basics of security.

For example, telling someone that "oh, you know that not having encryption …

cybersecurity cybersecurity risk fake management risk risk management work