it is theoretically possible for a miner to manipulate the timestamp in the block header before mining the block, but doing so would require them to solve a computationally difficult proof-of-work algorithm.
Which makes no difference to the miner. It doesn't matter if I set my time stamp to 1 hour ago, right now, or 1 hour in the future. I cannot know what difference doing that will make to how much work I need to do to solve the block, and the average amount of work needed will be exactly the same. In fact, miners frequently do increment the timestamp allowing them to then reset the nonce and extraNonce fields.
In addition, if a miner were to manipulate the timestamp, the block would likely be rejected by the network because other nodes would detect the inconsistency between the timestamp and the actual time when the block was mined.
Only if the timestamp fell outside of the allowed window, which is between the median timestamp of the last 11 blocks (plus one second) in the past, to 2 hours in the future based on the adjusted network time. This gives an average window of 3 hours in which the timestamp can fall.