Applicable Law
There are (at least) two levels of regulation involved.
At the state level, all fifty states and all or almost all U.S. districts and territories have enacted laws requiring notifications of data breaches.
Under the Securities Exchange Act of 1934, publicly held companies also have to make regular reports to the public via the Securities and Exchange Commission, some of which are on a fixed schedule and some of which are episodic for extraordinary events. The requirement under that '34 Act is to disclose all material information about the company that a reasonable investor would be influenced by in making an investment decision. There are regulations and there is case law governing what does and does not have to be disclosed, but there is still a great deal of discretion in deciding what to include.
But if your company fails to disclose information under the '34 Act and an investor sues the company for failing to disclose it, and a judge and jury handling the case determine in the court process that the information had to be disclosed under this vague standard and that someone was harmed economically as a result of the non-disclosure, then the company (and often people affiliated with the company) have liability to the people who the court finds were harmed by the non-disclosure for securities fraud and that liability cannot be discharged in bankruptcy in most cases (and is also eligible for special treatment in the debt collection process to enforce the judgment).
Application
If I run a publicly traded company that's releasing hardware and that
hardware is compromised and customer data is harvested, do I have to
publicize that leak's existence?
You do if it is of a magnitude covered by state law, or if the existence of the leak would be material to an investor in the company's securities (either stock or bonds).
What if the people that found that data are presumed to be trustworthy
and are willing to destroy the data upon payment?
This depends on the language of an individual state disclosure law at the state level. At the federal level, the question is whether the event is material. A variety of factors could influence that conclusion. One is the amount of the payment. Another is the extent that it indicates a problem that is likely to recur, or reflects deeper management problems in the company's IT systems.
Does that material breach have to be announced?
If the breach is material, it has to be announced. The timing of the required '34 Act disclosures is a rather arcane matter best left to specialists.
Note, this is about the Ubiquiti breach which is described as
"catastrophic". If they had paid the researches/hackers, and were told
that the customer data was destroyed, would that breach have to
announced to share holders? Can these matters legally be handled privately?
See above.
