If the pool is stealing from miners, it's not like sometimes they're going to cheat and sometimes they're going to sneak in bonuses.
I think this is an excellent point. Pretend you are a pool operator out to cheat. Having 5 visibly bad days seems like a bad way to steal. It would be both easier and less visible to skim off a small amount on a constant basis rather than inserting code that robs a large amount on a set schedule.
And either way, the best way to catch it would be to look at the average over the longest term possible. You can always find bad days. Half the weeks will be below average. And if you get to pick the start date and the finish date specifically to bracket a run of bad luck, you can always find improbable events.