In order to give a player a concussion the NPC needs to target the player's head, and the AI in rust naturally doesn't do that. Similarly with the broken leg, the NPCs don't target legs, they aim for center mass.
The best I could do to fix this is make it so there is just a random chance they inflict these things when they damage you, but it wont be because they actually hit those areas. The issue with that is that a player could have their head completely behind cover and could still end up with a concussion, same thing with the legs. I could add this, but it might confuse/frustrate players.
EDIT: I think you can actually configure it to do this if you want. Try adding the entity shortname of the NPC to the infliction entities list in the config for brokenleg and concussion and give it a high value (just for testing) like 1.0. You can further set the Infliction Damage Action to "ranged" so that only guns will cause the effects.
"Infliction Entities": {
"shortname of the npc here": 1.0,
},
"Infliction Damage Action": "ranged",
The short name of the NPC depends on what plugin added it.