Curious about this. Perhaps my understanding of a 'block withholding attack' is inaccurate, but are you saying (bolded above) that if a block withholder finds a block they can keep the 25 BTC reward for themselves?
My understanding has been that they can withhold a winning block from the pool, but it wouldn't be seen as a 'winning block' to the bitcoin network (only to the pool) so they wouldn't get the 25 BTC reward either.
You understand correct, but a block withholding attacker would be paid by the pool for all his submitted (non winning) shares. So he would earn just as much as a regular miner per GH. Well, minus that one winning share

Just so.