1) not sure how, I mean they can just change the website and remove miners they don’t want to pay and pretend they were never there. Or add some fictitious miners with huge hashrate to siphon money off to themselves.

2) yea, dunno, obviously they’re custodial for smaller miners. I’m dubious “custodial” is the right way to think about a pool. More like “liability” - the pool has some liabilities to their users which build up over time, and the user can withdraw at some points. They aren’t depositing and don’t really hold custody, they just build up liabilities.