Malware Caused Major Drop in Rankings. How long to recover?

Hi,

In January of this year, I was called to work on a site that had worked on before experienced major hacking. It had been hacked for over 2 months and had millions of pages injected into the SERP. All of the URLs have been removed from the SERP, but they are now showing as 1.7 million 404s in the google search console.

The site is fully cleaned and has been worked on since then, but rankings have never recovered. In fact, we are ranking for zero keywords on mobile! We are only ranking on the local map pack. I'm extremely concerned that we will never rank again. When I worked on this site previously I got us up to 30k visitors per month and now we are at like 2-6 people visiting a day from desktop only.

There are no security issues or manual actions in search console.

What do I do? What would you do? I've cleaned the site, removed the hacked URLs, but it's now June and it's been about 5 months since I've gotten those URLs cleaned off and nothing is happening. I'm wondering if it's futile to continue to work on this site.