While most existing works ignore securing the communication of control signals in microgrids' centralized secondary frequency control, here, a stochastic game between the microgrid control centre (MGCC) and the attacker for enhancing the vulnerability of the MGCC to false data injection (FDI) attack (wireless spoof attack) is proposed. The vulnerability to wireless spoof attack is assessed based on the controllability Gramian when the FDI attack is modelled as the malicious control input that aims to drive the microgrid state to undesired values. In the formulated zero-sum two-player Markov game, the state is uniquely associated with the vulnerability index defined by the trace of the controllability Gramian with respect to the attack input. Moreover, the utility function of the stochastic game includes not only the costs related to conducting spoof attack and encryption actions but also the possible remedy costs associated with the resulted vulnerability levels. In turn, the potential impacts of the cyber-layer action choices on the performance of the physical power system are considered when designing the optimal attack and defence strategies. A distribution feeder system with four distributed generators (DGs) is used for simulation studies. The vulnerability assessment results show that the vulnerability level increases when the attacker compromises more on the communication links between the MGCC and DGs. In the simulated game, mixed stationary attack and defence strategies are predominate when considering the uncertainty of the other player.This is an open access article under the terms of the Creative Commons Attribution-NonCommercial-NoDerivs License, which permits use and distribution in any medium, provided the original work is properly cited, the use is non-commercial and no modifications or adaptations are made.