This article from Ryan Quint, Senior Manager, Advanced Analytics and Modeling at NERC should serve as a wakeup call. He cites several real and challenging issues that must be addressed as DER continues to add supply to the system at an accelerated rate. One item that was not mentioned in the article, but is noteworthy, comes from one of the embedded reports (Summary of Activities: BPS-Connected Inverter-Based Resources and Distributed Energy Resources) containing a stunning revelation: "the vast majority of solar PV plants connected to the BPS, totaling over half the capacity, are not considered BES and are therefore not subject to NERC Reliability Standards"
This is reason for concern, especially from a cybersecurity perspective. That's a lot of software that needs to be installed, patched and maintained, in order to "address vulnerabilities".