> Even if I assumed maximum malice, how are these inverters going to perform a coordinated attack on the grid?

They’re network-connected and remotely controllable. The concern is compromise of the vendor/cloud infrastructure allowing large numbers of inverters to be manipulated simultaneously.

Or even Trojan horse style malware is a possibility I suppose (Stuxnet).

That’s basically the threat model that they are using. If people want to argue with that, then that’s something to poke at

AC power needs it's sine wave aligned or it's very bad. If a huge chunk of inverters all start dumping power onto the grid that isn't synced, things break.