He can’t give the attackers the customer keys or any other data. But yes as another poster says downtown the attackers may not actually understand that.
Why don't they bother traditional bank managers then?
One time long ago someone did try to get money by forcing a bank owner to open a vault, and it didn't work, and since then everyone knows it's fruitless.
It just needs to actually be fruitless. It sounds like for crypto custodians, it's not fruitless and they know that.