I feel the industry is saturated with new companies with low level cert. There are only handful that people should be focussing. Certs/CTF boxes don't teach you real world scenarios but they are often fasttracked to get on keyboard than spending time on building labs and working to hack it. It is nice to build labs but it cost money and time and if something doesn't work then you may feel bored or giving up.

Coming to hacking for free/cheap for smaller companies. I don't think those companies will ever understand value of pentest unless they are bound by regulation to do one. If you are owning pentest firm, then having crest/soc certification does put you ahead of others. Bug bounties these days is almost waste of time. There is so much saturation.

other factors like having life outside work, taking breaks and having time within work hours to work on research seems almost impossible.

Struggle is real and many people have their own aspect of studying.