Can sys.database_permissions contain REVOKE?
REVOKE doesn't just remove access, rather it undoes a specific permission that was either explicitly given by a GRANT or DENY. In other words, if a permission is explicitly denied on an object for a security principal (e.g. User, Login, etc), that explicitly denied permission can be removed by using REVOKE on it.
After some research it looks like the use-case for &quot;R&quot; as a potential value of the state column in the sys.database_permissions view is for column level permissions that contradict the parent table's or view's permissions as per this Stack Overflow answer by Mark Chesney:

For objects which can have column permissions, such as tables or views, the presence of DENY or GRANT object permissions requires REVOKE for column permissions to be persisted.