('How vulnerable' is a bit tricky, as there is no unit or scale.)
Assuming that the Bad Guy can see all internet traffic, owning relays does not help much for timing correlation attacks. You're always vulnerable to those, no matter who owns which relays or how many. (Generally, more relays and more traffic make it easier to hide.)
Besides timing, which is a bit fuzzy and becomes harder with more traffic, the only real way to know which incoming traffic belongs to which outgoing traffic is to own the relay. Each relay in a circuit knows who is the previous and the next relay; where packets come from and where they go to. Only the exit node can see the actual traffic.
Client --> Guard -> Middle -> Exit --> Destination
The Bad Guy would have to own the entire circuit, Guard, Middle, and Exit, in order to see and follow the traffic from the Client to the Destination.
Finally, if the Bad Guy owns a bunch of relays, they can still not target anyone specifically. They have to sit and wait and hope that someone happens to create a circuit using only their relays.
The probability would be something like (( bad / ( good + bad )) ^ 3 ) except there are other factors at play, like conditions to become a guard and client guard rotation.