Review comes as Pool Re pays out just £10m to businesses in 5 years to cover cost of terrorist attacks