I don't think I'm in a position to comment on the issue or on the link that there may be between industry concentration and infrastructure vulnerability.
I feel that what is going to be more important than market dispersion is redundancy of infrastructure, as well as having backup systems and having thought about resilience upfront, no matter how many players are involved. Someone has to think at some point about what would happen if such and such an attack happened against such and such an infrastructure and so on.
I have a feeling that maybe that's where we should start.