That would be quickly become knowledge and the mining pool would hopefully lose all their business very soon. With that logic an attacker could use a lot of fees to launch an attack successfully. Much above average fees would signal bad tx's immediately. A lot depends on the visibility of actions of miners. Which is why the supposed selfish mining attack was not considered really serious.