No matter what given that all claim to have many many users, why is it so hard for someone - anyone - that uses 3rd party firmware to post proof it has found a BTC block? Most GUI's have a spot for it and a record of blocks found since last reboot is part of the API so can be checked even outside of the miner GUI.
On the pool side of things, when shares are sent/received information about the miner is provided as well to let the pool/miner work together. Plus when a block is found the block header generated includes information about the actual individual miner that found it. That info is more than just 'running cgminer vxxx'' and is easily logged by a pool if they care to keep detailed logs, for a start
Since Slush is behind the bOS projects, why not provide simple, verifiable proof the stuff finds blocks? They certainly have a large enough data set to see what miners (or, ahem, large proxy) find blocks and compare that against expected finds vs hashrate. So, if responsible pool operators want verifiable proof firmware works - give it to them.
Oh, their Stratum redeux freely gives a pool, sorry - they call it 'Service' -that info and knowing in-depth what a miner is running and can do is a large part of what it relies on to do the voodoo they plan on it doing.
Then there is #xnsub being part of it... While not an issue per se #xnsub opens up a rather large security hole and exists (so far) only for the benefit of Nicehash and DevFee firmware. It is how NH is able to change work done w/o having to restart a miner. It is also used by DevFee firmware to mine at their payment pools in the background without the miner needing to change pools & restart. Yes a lot of miners support #xnsub and yes BM had to reinstate support for it again after folks bitched about not being able to use their newest miners on NH. That still does not make it a good thing...