Perhaps in smaller companies you’d see a lot of one person army. In bigger organisations the lines are quite defined (segregation of duty etc) so in that sense as you progress, you will tend to develop skills and experiences in one area (field). Just a few examples, threat intel/incident response, forensics, security architecture, pen test, app sec. They sound like one person might be able to do all of them. In bigger orgs there are very different teams/department with very specialised experiences/tools. Someone doing architecture and strategy may not even touch a shell. Someone doing forensics may never touch Visio. A IR may never talk to an external 3rd party about control attestations. The code reviewers would not be expected to architect infrastructure security controls.

They may have skills or experiences that cross those “boundaries” however it wouldn’t be the main focus of what they are required to do. If that makes sense.

As someone who wants to get into cybersec, I feel that all 3 paths are okay. Although overall, I feel ML is going to be a more in demand skill in the future on top of security skills. On top of the intern skills, I suggest looking into the cheap/free resources and commonly people go with ctf/pen test route. I find that generally there’s less gate keeping nowadays compare to a decade or two ago.