How is joe schmoe going to know which downloads are safe?
Well, if the executable itself is altered, that can be determined with a
checksum.
If, on the other hand, it's just a matter of someone at CDProjekt seeding a torrent and IP-checking everyone who grabbed it, well...it's still early days for anonymous torrenting, but it'll become a lot more common as stuff like this becomes more common.
But BT is far from the only way to download files. Encrypted Usenet servers are easy to find; they cost money and it's a little more complicated than BT, but that route's open to savvier pirates.
None of which is to say I don't love the idea of just sending bills to people. But it's already been established that IP addresses are not legally binding forms of identification (in this country, at least), and it's not a long-term technical solution for the reasons outlined above. Given CDProjekt's track record, I'm confident they know all this and are doing this simply to make a point. And as points go, it's a perfectly good one.
(Tangentially: Back in the golden period of EC Comics, they ripped off a Bradbury story. Bradbury sent them a letter politely explaining that they must have forgotten to send him his check for the rights; Gaines cut him a check and Bradbury has been a staunch supporter of the old EC stuff ever since.)