I think a college graduate with 2030's Metasploit probably would be enough to force the web to secure itself. A cynic might say 2021's Metasploit is enough.

It's hard to guess how big REvil would be. From their job ad -

"Teams that already have experience and skills in penetration testing, working with msf / cs / koadic, nas / tape, hyper-v and analogues of the listed software and devices.