Public mining pool account w private access
Pools either don't use a password for mining clients, or they use a password different than the one used to log into the website and change things like the cash out address.

So you don't really need to worry about this happening. Just don't choose the same password for mining and website access, if the pool asks you to choose two passwords.

What could happen though is that they change the mining client config to mine for their pool account instead of yours.

There is also the special case of a pool or two that accept the user name as the cash out address. In those cases someone could change where your coins go simply by changing the user name in the client setup, because the user name and cash out address are in this case the same thing.