Concentration is often a deliberate, reasonable tradeoff
A single policy engine every service consults, a single identity provider every application trusts, a single administrator account with broad standing authority — these concentrations of dependency are frequently the reasonable result of deliberate design choices, not oversights. Centralizing a decision often makes it more consistent and easier to reason about than scattering it across many independent implementations.
The risk isn't that concentration happened; it's whether the resulting single point of failure was named and accepted deliberately, with a plan for what happens if it fails, or whether it simply accumulated unnoticed as the system grew and nobody stepped back to ask what a compromise of that one component would actually mean.
What to do once one is identified
Not every single point of failure needs eliminating through redundancy — sometimes the more practical response is accepting the concentration but investing heavily in detecting and responding to its failure quickly, since redundancy for something like an identity provider carries its own real cost and complexity. What matters is that the decision — accept, add redundancy, or invest in fast detection — is made deliberately, for each component identified, rather than left as an unexamined default.