Regardless Coinbase get scammed or not, they should give the $20 Million, all they can do is fulfill what the attackers' wants.
What if it was just an initial ransom? The users data is already in the hands of the attacker and can be copied infinitely, coinbase is a large scale business that I think it would be stupid not to realize this extortion attempt will end in a ransom price of $20 million. This is not a new crime story in this industry.