Once you have control of the wallet, that user could deduct whatever they want. It's a risk for both parties. 
No, it's not. The OP isn't really risking anything at all. However, it is a risk for anyone that attempts to waste time and money and resources on this, that the OP will never pay up on their 1 BTC "promise".The OP has only provided a "hash" that has been extracted from the target wallet.dat file... So, even if you were to "crack" this and discover the password, it is useless to you because you don't have the wallet.dat to be able to use the discovered password.