You don't need to resort to power law wealth for masternodes to be Sybil attacked. If they are an investment that is priced for a market return then someone who wants to also use them to spy has a competitive advantage. That being the case one should expect that every masternode in a competitive market is secretly spying. Similar to your argument about who is providing Tor bandwidth for free.
I doubt they would "destroy their investment" by spying, as with all intelligence sources the spying would be kept secret in order to protect its value.
Every masternode could be spying, but unless they are co-operating there's not much for them to gain. Competing investors co-operating in competitive market? Nahh...
But the thing is, look at the masternode distribution, you don't really need a sophisticated attack - a simple email to amazon, ovh and do from the FBI and they have access to 90% of them.
Distribution by operator is what it is mainly because the first guides written on how to set up a masternode used Amazon as an example, and people were already familiar with those big operators. So the people who wanted to have a node running asap with minimal effort started using those. We'll see if the distribution will change as time passes, probably at least some kind of education on the matter is needed.