Since the dominant pool (foundrydigital.com) only has 28.4% of the network, they can't do the 50% attack, given if the second biggest pool decides to work with them they will have 49.8% of the network, so, not enough to manipulate the blocks.
The more hash power a mining pool own, the more chance they have to replace an existing block with a new one. This doesn't mean the mining pool have to own more than 50% of the total hash power to do so. Any mining pool can try to perform such an attack even with less than 50% of the total hash power.
This is correct that any mining pool can try to perform such attack but the rate of chances that the attack being success would be very much low success and if the hash power is much more lower then chances of the attacks would also become more less than it is.