There will be validator pools available for those with small amounts of ETH
The equivalent in PoW world would be someone breaking in and leaving with all the GPUs of all the users of a pool, what I would consider not dooable for a large enough pool.
When your staking time is up, then you can withdraw it. Smart contracts could be used so that multisignature wallets could be used which would prevent a hacker from taking funds provided to the mining pool.
I think a few friends and I are going to start a validator pool when time comes to switch over.