Is this roadmap realistic for becoming a Web3 Security Researcher? Looking for guidance from experienced auditors