Currently, or before some time, the miner uses ccminer/spreadminer/sgminer and connects to his local wallet via an unencrypted connection i.e. everyone could read the privkey by listening to the connection, using wireshark or even by intercepting the data communication (Man-In-The-Middle)..
This is also a big security flaw for the coin if (private) miners are connecting to their wallet over the Internet i.e. their Rigs are not only local in their own network, as everyone could literally steal their private key.
One thing i've done is: I've encrypted all data between the pool and the miner, it uses a secure SSL connection, its the same kind of connection you use when you're doing online banking etc (https) so if you want to sniff on the data - you first have to break the SSL encryption and then you can steal that one session key :-)
The second thing is, "normal" miners don't work, I've simply tweaked them to refuse all kind of unencrypted connections and also added an extra certificate with some encryption so the pool recognizes exactly which version is used by whom. Thats why you need to use special versions of miners, they are simply of higher security.
In other words, you just made SSL stratum. So miner know what data received from pool anyway, because he must be able to decrypt private key in order to sign block. If miner know private key he can steal coins.
Also, there is no flaw in coin, miner should care about his security and don't expose daemons to wild, if he has geographically distributed devices he can run daemon per subnet or make special secure network. But i agree, Mr. Spread probably can add optional SSL support to daemon and miner. Currently it's equal to regular bitcoin clone solo mining with unencrypted wallet, because rpcpassword is transfered unenctypted in all bitcoin forks between sgminer and daemon.
PS: I can't remember Mr. Spread ever said that SPR is pool-proof, it's pool-resistant, because it's impossible to deny people from sharing efforts to make some work together and share results. In very weird case miners even can make an agreement and mine solo, then share coins if they are honest.