Due to the efforts of digitization of power grids and integration of online diagnosis systems, today's power transformers have been promoted to deploy seamless communications and information technology, which potentially presents growing threats from cyber-attacks. This paper provides security vulnerabilities and potential threats of power transformers in cyber-physical environments through a security threat modeling methodology. The proposed security threat modeling includes three steps: 1) system identification, 2) threat modeling, 3) and attack modeling. The devised security threat model can identify potential vulnerabilities and threats as well as simulate attack success rate, which will be used to develop device-level defense strategies to protect power transformers from malicious cyber-attacks, ensuring the secure utilization of the cyber-physical power transformers in modern power infrastructures.