Is MARAPOOL a public pool? The problem is that you need to trust not just the employees of MARAPOOL but each member of the pool. The block template is broadcasted to them and the public key is clearly part of it.
With "pool miner" I mean someone with mining gear participating in mining in a public mining pool (which MARA pool isn't) where anybody can mine its shares for the pool to find a block.
Why would a miner in a public pool need the whole block template? He needs only the 80 bytes of the block header, not all the block's transactions!
As long as the number and sequence of transactions in the to be mined template block aren't changed by the pool operator the Merkle Tree Root Hash doesn't change and a miner only needs the short block header where all transactions are condensed to the Merkle Tree Root Hash.
A pool miner can then hash crunch varying the nonce and maybe also the block time. Fiddling with the extra nonce in the Coinbase transaction wouldn't be possible for a pool miner IIRC as he doesn't own the private key to sign the Coinbase transaction anyway, thus he can't change the extra nonce field of this first transaction in a block.
I think I know how mining works, maybe not the very inner mechanics of pool mining software for sure, though. Correct me, if I'm wrong, always eager to learn Bitcoin's details properly.