How Realistic is the Centralisation Risk of PoS?

A popular criticism following the Merge is that 4 entities own 64% of validator nodes. 3 of these are exchanges (Coinbase, Kraken and Binance) which are centralised and they'll have to adhere to wallet blacklists sent by the government.

If they were to control >51% of nodes, Ethereum's defense mechanism is to slash them. But the slashed ETH will come out of customer deposits.

Is this scenario realistic and is the punishment fair for customers?