Slush pool adds automatically the IP of the user to the whitelist (from the web browser), while allowing to add new IP's in the account screen. The people less experienced usually has the miners in the same IP, and the people that has big mining systems know how to add an IP to a list.

Also, I believe (but Im not sure) the whiltelist is off by default and only goes on when there is an attack on the pool.