I have doubts that the RE is correct!
I noticed the same two things you did.
1. The two top NPN in the DIFF DRIVER schematic get no positive base current.
If these were on the emitter side of the differential pairs instead of the collector, then they would form a linearized cross coupled quad which I doubt a high bandwidth vertical amplifier would need. On the other hand, I would have expected a cascode on the output and they are in the right spot for it except for their base bias.
I see no thermal balancing on the collector side of the differential pairs. Maybe that is what these transistors are actually doing?
The DS1000Z user guide does not say anything about separate position and offset controls and confusingly lists an offset range in the specifications but discusses vertical positioning so my guess is that the connection to the other side of the differential pair is for controlling the common mode level going into the ADC.
2. The DC-path from the input in the mode w/o attentuator only see 222k+265k instead of 1000k
Yep. Something is missing or wrong here. The input attenuator was obviously designed for a 1 Mohm input resistance. I wonder how Rigol calibrated both the input capacitance and compensation with only one trimmer. Maybe the manufacturing tolerances are good enough not to require it.