Attacks on American power systems are likely to be small and localized, according to a cybersecurity firm, casting doubt on the ability of a foreign power to take down broad swaths of U.S. electric systems at once.