Anyhow I dont see how you could delay/alter any of the public non-user specific api feed without also delaying it for loyal users as you seem to mention here.
Sure he can, just like he tampers with the connection of your worker he can delay the stats for the same IP.