Well, first, I'd expect Boeing already had some idea of the scope of what was compromised simply by investigating their own systems. After all, they knew enough

Well, first, I'd expect Boeing already had some idea of the scope of what was compromised simply by investigating their own systems. After all, they knew enough to declare there was no impact on flight safety. And second, even if a company has no idea of the scope, the hackers would somehow want to prove at least privately what the scope was, else their threat is not as manipulative as it could be. On the other hand, the hackers can't credibly bluff and inflate the scope too far beyond reality because the company can just say "prove it or I don't believe you and I won't pay." And the hackers want to get paid. It's a business deal after all. A really crappy one involving criminals. But at the end of the day, the company must have already assessed the value of the leak in order to reach a decision.