It depends on the implementation. As you saw p2pool pays you directly from the generated 25BTC.
So does Eligius, it seems; see, e.g., this. AntPool, however, takes the entire reward to one address; see, e.g., this. That latter method seems much more prone to fraud.The pool makes the transaction in both cases ...
Paying later really isn't much difference either since you can look at the payout method and (if related to the payout) the block find history, and determine what you should be paid.
All 3 are transactions created by the pool and similar fraud can be done in all 3.
