I have always been after this type of data, or more to the point the raw data underneath. I am not sure what BDR is or what the math is behind your CDF figure but given the raw data is it possible for you to confirm that all of the devices are finding a similar number of blocks on average for the same amount of work. I want to put to bed the conspiracy that a particular type of miner firmware could send a low number of successful blocks to a different IP than the pool it is working for. A single UDP packet containing a small simply encrypted string to a common range of IP addresses such as one in AWS would be difficult to spot but 1 in a 100 or so additional found blocks would certainly help a pool out. Data like this would help to spot an underperforming type of miner.
I don't mean to be rude but to believe this "conspiracy" requires ignorance about how mining actually works. My miners could supply the solution share that was high enough difficulty to make it "a block" to anybody in the world, but it would really only be useful to the pool that sent my miner the work, because only that pool has everything else that is required to make it an actual block on the network. Miners don't work with all of the actual data that comprises a block, if they did, the bandwidth required for mining would be enormous and it would essentially make pool mining pointless anyway. The full block data also includes the payout address or addresses. The solution share is only a solution for the specific data the pool is working with, meaning the specific set of transactions, including the payout transactions. So in other words, a "block" on the miner side is only an actual block on the bitcoin network when you have both the specific transaction pool (which the mining pool has and which is constantly changing as other bitcoin blocks are mined and new bitcoin transactions are made) and the solution share (which the hardware miner finds). So again, the solution is only a solution for the pool that provided the work. You might have some confusion based on the fact that it is common to talk about how a miner finds a block when in fact what the miner finds is a solution share to a set of data that only the pool has.
If you want an actual conspiracy idea then ponder the notion that the firmware is dropping certain solution shares instead of submitting them to the pool (whether by design or by accident). You can't directly help another pool that way but you could hurt the pool you are on (and if you are a hardware manufacturer who also runs a pool then you can sell these miners to your competition and hurt them). This is why that data that Kano posted is useful. S9 firmware with BMminer v 1.0 appears unlucky. So the only question is, how likely is that luck? The recent luck on this pool has certainly deviated into the realm of unlikely but is it unlikely enough to say something is definitely amiss? It's pretty unlikely that your life will come to an end due to the actions of a crocodile, and yet some humans do meet their end that way. Even very unlikely things happen.
One thing to note, new firmware for S9's that includes BMminer v 2.0 does work on the old miners (assuming the firmware upgrade succeeds.) BMminer v 2.0 does not appear unlucky in Kano's data. But of course this is only data from one small pool. BMminer v 1.0 might have average luck when a larger data set is seen.