Leaving aside any attacks on the control system, the actual physical infrastructure is quite vulnerable. It operates close to breakdown on many days anyway, so it would just take the loss of some critical lines and maybe substations to cause (if lucky) widespread controlled blackouts and load shedding, or if unlucky, uncontrolled massive blackouts.
Since 9/11 they've fortified certain pieces (in the late 1990s, a 3 guys with crowbars and pistols could have broken into major grid operations centers and shut them down), but a lot of it is still fairly vulnerable.