There was one block withholder, and there's no proof that he was a bad actor - from everything I've read he was mining in ignorance of the state of his hardware, and fixed it once he was told there was a problem. The fact he isn't going to repay the coin he took reveals him as a bad actor of sorts, but I don't think you were referring to that.
Curious about this. Perhaps my understanding of a 'block withholding attack' is inaccurate, but are you saying (bolded above) that if a block withholder finds a block they can keep the 25 BTC reward for themselves?
My understanding has been that they can withhold a winning block from the pool, but it wouldn't be seen as a 'winning block' to the bitcoin network (only to the pool) so they wouldn't get the 25 BTC reward either.