The validity of the NDA is not an easy question, but a related one is more clear.
A lawyer in the U.S. in most states is not permitted to threaten criminal or administrative action (e.g. reporting someone to immigration or tax officials), to gain advantage in a civil case. You can unilaterally bring criminal charges or take administrative action, but it is deemed to be unethical and against public policy to refrain from bringing criminal charges or taking administration action to gain civil advantages.
An NDA of the type described arguably violated the same public policy and might be invalidated as a result.
Put another way, there is a privilege to make certain reports to public officials without legal consequences and such an NDA might violate that privilege. Some of these privileges found in what are called "whistle blower" statutes specifically prohibit this kind of agreement as to some specific kinds of illegal conduct, but not others. There isn't a general rule.
This said, it is not black and white. For example, a private NDA can't prevent someone from testifying under subpoena, but can prevent someone from voluntarily testifying in the absence of a legal compulsion to do so such as a subpoena.
Suppose a woman is sexually assaulted at work, and is given an NDA to
sign. Can the company legally require her not to disclose the conduct
of an illegal activity?
I can imagine this example coming out different ways in different jurisdictions.
For example, some states have a legal duty (rarely enforced) that requires people to report felonies, and an NDA in this case would contradict that affirmative legal duty, while others do not.
Another source of gray in the analysis is that there is a difference between not reporting a sexual assault that actually happened, and, as part of a larger settlement, executing an affidavit stating under penalty of perjury and under oath that a sexual assault didn't happen. The first is potentially an NDA that is void as a matter of public policy. The other, in principle, is a settlement that the person signing the affidavit can only enter into if it is true. There is nothing, in general, wrong, about requiring someone to confirm that certain representations are true as part of a business transaction or contract and allowing the contract to go forwards only if certain facts are true.
The gray gets deeper, because whether a sexual assault happened or not is not always a subjectively black and white clear issue of pure fact. (It is subjective because an affidavit or affirmation is made to the best of the declarant or affiants' knowledge and belief, not as a matter of objective fact.)
For example, someone may not have perfect memory of what happened, or there could be doubt over the question of whether the perpetrators acted recklessly (the Model Penal Code intent requirement for sexual assault) or merely with criminal negligence (which would not be sexual assault under the Model Penal Code).
A statement made under oath about whether a sexual assault happened to the best of your knowledge, thus, might be a mixture of factual issues (A penetrated B at a certain date and time) and legal or not perfectly factually known ones (A acted with X intent regarding consent during that act).
So, in a case where there was some room to argue either way about how to characterize what happened and about what actually did happen, there might be some room for a settling party to make a non-perjured statement consistent with the settlement and then to agree not to a true NDA, but instead to not make statements which, if the affidavit is true, would be false.
In a plea bargain in a criminal case, one can plead "no contest" without agreeing that the crime factually happened, but that isn't really possibly in the context of an affidavit about what really happened, with an NDA limited to not disclosing the incident since it was already agreed as a matter of sworn fact that there is nothing to disclose that rises the level of a crime.