What's to stop the group from releasing them anyway? What happens to the files on the hacker's drive - surely the hackers won't delete the files? That would give up the leverage they have. If the files are out there, they could even be leaked by accident (hacker loses laptop, drama in hacker group causes member to rebel, rival group hacks this group, etc)

Risk-wise, I think nVidia has no choice here. They should assume the Verilog source will eventually be made available. The only question is whether the time between now and then is valuable enough to give in to the demands.