Here are some attacks which are affected by the number of nodes and/or miners and/or hashrate:
Attacker: Miners
Attack: Double spending. A miner can spend bitcoins on a product or service, then produce a block which invalidates the spend
Probability of success: 100% when the hash rate of the attacker exceeds the hash rate of the rest of the network
Severity: Number of bitcoins controlled by the attacker * number of attacks performed
Attacker: Miners
Attack: Denial of service. A miner can engage in selective censorship of transactions
Probability of success: 100% when the hash rate of the attacker exceeds the hash rate of the rest of the network
Severity: % success rate of censor identifying transactions they wish to block * value of the blocked transactions
Attacker: Nodes
Attack: Double spending. An attacker can defraud a target who is using an SPV wallet by providing them with invalid block headers which allow the attacker to pay the target with a transaction which references non-existant inputs
Probability of success: 0% unless the attacker can prevent the target from communicating with any honest nodes
Severity: Number of bitcoins controlled by the attacker * number of attacks performed
1) Attacker: Miners
The key question here is do larger blocks even change the mining ecosystem, because if larger blocks do not effect miners then the point is moot since the attacks are the same with or without larger blocks.
There are good reasons to believe that larger blocks do not effect mining. Miners already have centralized on pools, which themselves are large enough to scale up resources. Pools do not have to be physically close to miners and can (and should) migrate to well networked regions and cloud services.
Miners themselves already use the stratum protocol that require < 1kbps connectivity, they are not impacted by or see any effects from larger blocks. The pool handles the block, while the miner just processes a data packet that is the same size regardless of blocksize.
2) Attacker: Nodes
As you point out, all you require is a connection to one honest node and that honest node can expose any attack. If 50% of the P2P nodes are coordinating an attack and a SPV wallet connects to 8 random nodes, then the probability of success is 1/2^8 or 0.39%. This attack is very difficult with a larger number of nodes.
In the case where P2P nodes become highly centralized (let's say they are reduced to 25 very large entities), then it is likely that several of those nodes would be trusted volunteer efforts (think an EFF node) or run by trusted entities (think a shared ivy league university node) and SPV wallets would be programmed to require connections to a least a few trusted nodes. This is probably an even more difficult attack than today where we have 6K nodes, since it is relatively easy to spin up 6K nodes in AWS for the short period of time needed.