Yes, I think it'd be an attack because Ocean would be crediting the attacker's shares to receive payouts from other honest miners, while they'd get to keep the full reward when they find a block. However the protocol doesn't assume that miners behave honestly because they share their templates with the pool for inspection:

GitHub

Stop sending block templates to pool · Issue #1 · OCEAN-xyz/datum_gateway

The current version of DATUM shares the templates with the pool, but it would be more robust if we didn't. For validity checks, we can share encryp...

Sharing the full template is not strictly necessary, though. I believe the datum_gateway could just send the block header, the coinbase transaction and a Merkle proof of inclusion of that transaction. But I don't know if that's what they have in mind for future versions of DATUM.