This is exactly what will happen now since the difficulty is slowly (and delayed) adjusting upwards long after the attack has stopped, which means the genuine 24/7 miners which actually secure the network will mine against a high difficulty (which comes too late), will waste lots of electricity and get very few blocks, i.e. coins. They basically subsidize the coins stolen by the nicehash idiot. Yes, I consider it theft because the nicehash attacker is not willing to mine at the difficulty his hashrate generates. That's why he ran away after a short time and doesn't mine 24/7, knowing exactly that the invoice (difficulty) is presented only after the fact and he can leave it to the other miners.
The network difficulty has slowly ramped up to 20M now, despite the attack being over since more than 8 hours and the global hashrate back down to 50kH/s ever since. This is two times the 10M it had when the attack started. Blocks come in very slow therefore. The last 20 blocks took over 3 hours to mine (almost 3.5 hours), which means the
miners are now earning less than one third of the coins they should earn for a couple of days to come until the difficulty will be back down to 10M. They are paying for the nicehash freeloader. If they are unlucky the freeloader will return just when the difficulty is again back to nominal. Rinse repeat.
The pools are certainly not earning more fees due to such incidents. Because the long period of slow blocks and less fees (per hour) now will make up for the short period of more fees (per hour) during the attack. I am therefore puzzled why they would actively invite nicehash attacks by providing a dedicated port just for this centralized service.