If a pool makes a payout, the mechanism that performs the payout must have use of a private key. Therefore I don't believe there can be any secret to securing this private key beyond good operational security best practises. This would include operating with a minimum of "cash-on-premises", so the wallet used by the payout mechanism would only have enough BTC to cover payouts for the next few days, relying on refills performed by an entirely separate, manual process.