1. Miners will have nothing on them (and you shouldn't have anything more then the bare minimum on a mining system) so there is nothing to compromise.
2. If your earnings are being 'hijacked' you'll notice it in your global earnings. He could actually be lieing about the 2% and it could be closer to 5% and that would be more likely then it randomly mining whatever he wants. Matter of a fact that could be slipped into the miner and there would be very little to prove it as he can easily mask the 'dev time'. If you think you can easily notice the difference between 2% and 4% pool side you'd be wrong. Depending on the pool, pool luck, and if the pool is skimming (which isn't uncommon with some pools) it's practically invisible.
I'd be more worried about shit pools then ultra vetting a miner. Not saying looking out for a virus is a bad... always look for a virus, just some people go way too overboard with things.
I'm running the nvidia miner on my gaming rig so I'm very paranoid. My mining rig is filled with RX 470s and they're the ones I'm not worried about since they run on the bare minimum. I'm actually more worried about trojans, keyloggers,remote login stuff since these are the ones I can't actually verify and monitor. The hijack thing you're referring to can easily be verified by anyone monitoring their miner's stats from their PC and on the pool.
and it's indeed at 2% since i'm getting the exact earning, i can't even notice the 2% and sure it's no more than that, but if the miner is infected with a malicious code/obscured code for a back door, you will never know it until some bad happen