Why small cyberattacks on power systems more likely than a long-running blackout