Anyhow I dont see how you could delay/alter any of the public non-user specific api feed without also delaying it for loyal users as you seem to mention here.
Sure he can, just like he tampers with the connection of your worker he can delay the stats for the same IP.
And you think I pull stats from the same ip that I connect from ? I have a completely seperate setup for where I pull server stats from mainly so it wont hammer it nor appear all botlike.