What is the rationale behind requiring "X years of working in cyber security"?

I graduated with an M.Sc. in cyber security two years ago and have been working as an information security consultant since then (basically the only job offers I got during that time were in consulting). A lot of roles that I am interested in require "At least 5 years of working experience in cyber security or information security", CISSP preferred etc..

However, my current role mostly consists of really elementary tasks such as reading or extending policies, evaluating compliance, gap …

consultant consulting cyber cyber security cybersecurity information information security job job offers roles security security consultant what is working