A malicious miner, working on an ATX to be published in epoch j, may start his PoET at the beginning of epoch j-1, and finish it in the end of epoch j, thus still publishing it on time (during epoch j), but gaining double ticks compared to honest miners (note that it can also publish it during epoch j+1).
More technically, this miner should have a Positioning ATX from the beginning of epoch j-1, thus his ATX Layer Index should be at the beginning of epoch j. Since at the moment we don't enforce Layer Index, in practice it can publish at the end of epoch j with no problems.
A malicious miner, working on an ATX to be published in epoch j, may start his PoET at the beginning of epoch j-1, and finish it in the end of epoch j, thus still publishing it on time (during epoch j), but gaining double ticks compared to honest miners (note that it can also publish it during epoch j+1).
More technically, this miner should have a Positioning ATX from the beginning of epoch j-1, thus his ATX Layer Index should be at the beginning of epoch j. Since at the moment we don't enforce Layer Index, in practice it can publish at the end of epoch j with no problems.