When you are running a miner in a pool, you communicate through
getwork protocol. It basically boils down to requesting work and sending back shares (and in rare cases, solutions to blocks). Work in getwork is a Block Header, not an entire Block. The coinbase transaction is encoded in the merkle root, but is not known to the miner. The block hash that creates a share or a block solution is ONLY valid for a given merkle root. If you change the coinbase, giving yourself all the money, you invalidate your solution and have to start over. If you are mining your own blocks, no pool should accept your shares (unless it is dumb).
To sum up - a miner does not know the coinbase transaction, nor can it change the block without invalidating it.
On the other hand, a miner can withhold a block solution while still submitting other shares. This will make the pool get less money while still having to potentially pay for those shares. This exploit can be detected by statistics though, so over a long period of time such a malicious miner can be found out.