w. When they do steal blocks they submit them under their private wallet, not through their pool.
But the miners found a hash for the block with an address belonging to a pool. Pool owner cannot change the address, as it would render the hash useless.
Pool owner can hide the block and don't report it on website and don't pay for it. If it is rare enough, then it would be hard to detect.