Most people will use the coordinator with the most liquidity and can't check in real time if hacked funds are entering the same round.