I've had this thought too - of the 13 root servers, 10 are US or US-based companies. The only exceptions are Netnod (Sweden), RIPE NCC (Netherlands), WIDE Project (Japan). Even ICANN and Internet Systems Consortium are US-based non-profits... How do you even mitigate risk in this case?