A terrorist organization, like ISIS can get their hands on a few kits, gather a few dozen smart guys and ask them to work day and night on creating say a "better" COVID virus they can spread in the West. They won't have problems supplying test subjects to the team...
To a lesser extent, there are some sort of universities in rebel controlled areas.
No idea how good/bad they are.
You're right about the university thing, though. It's never been that hard to get this equipment.
https://m.youtube.com/@TheODINinc
Or just search their lead person: Josiah Zayner
If you make it easier though, some organizations may reach the cutoff they otherwise couldn't.
With enough smarts and motivation, you can do anything. But the amount of these is usually a given and hard to change.
Just like people building their own nuclear bombs hasn't been a major worry.
The real issue is the CIA, FSB, etc. doing it deliberately.
[1]: https://www.theguardian.com/world/2003/jun/24/usa.science
That article is a nice thought experiment, but they didn't actually build it.
It's a little outdated at this point, but McPhee's 'The Curve of Binding Energy' is a fascinating read on this topic
That is an important part though.
I mean with enough motivation anyone (assuming they pass a background check) can pursue a degree in biology / genetics, get a job with access to a lab, and do the thing.