There was a rouge pool no so long ago got all the info of users and swiped all the coins of users using the same passwords on all sites . email confirms are good for safety. IMO
How shall this work? Every Pool I go I set a different login and password and I set the auto payout and every day I check that I got the coins. There isn't much too lose.
I much more worry that the email address I set would be missused.
So if there is really no other way I would anyway create an instant email somewhere and use that.
If your email provider has the functionality, just make an email alias that redirects to your main email account. If a "hacker" ever gets ahold of your email alias and password from a pool, they wont be able to login and validate transactions because you usually can't use an email alias login to your email account. Not to mention they will never get your main email account.