First off, finding 6 instead of 9 blocks would not be statistically abnormal for any reasonable definition of abnormal. Second, what is being suggested is making everyone mine in a pool that is only 200 Th/s. If people wanted to be in pools that small they would join pools that small. GHash is so popular exactly because people do not want to be in overly small pools.
Yes, over time things would average out, but you could say exactly the same thing about solo mining. In fact, over time you will make more solo mining than pool mining because you don't have to pay the pool fees. So why isn't everyone solo mining? Because we want lower variance than we get solo mining. No one would join a pool with enforced 200 Th/s sub-pools.
The definition of acceptable variance can be debated (wider window, longer time), but there's currently no mechanism to determine if some people or group of people are behaving badly. The notion of subgrouping helps identify the bad actors. If your "group" consistently performs below statistical expectation, then something's not right.
You could keep the payout as is, but simply start tracking groups of people for non-normal behavior... right now, everything is monitored on a total pool basis.
The question stands... how do you know if you're being attacked at a level that is not statistically acceptable (cost of business, assume some crooks always exist).