When I attack a BF with 2 hidden cards, if they don't activate them both right away can they activate it later?

Yes, the defender can activate their hidden cards later in the same showdown, provided they have not already passed their turn to conclude the showdown.

According to the Showdown Flow and Rule 347, a showdown only ends when both players pass priority in sequence without either player starting a new chain.

Here is the breakdown of how this works during your attack:

1. Priority and Focus: When you move your unit to a battlefield and start a showdown, the defender has the opportunity to respond.
2. Activating Hidden Cards: Activating a hidden card is a [REACTION] action (Rule 811.6). As long as it is the defender's turn to act (or they hold priority), they can choose to activate a hidden card.
3. Sequence of Actions: If the defender activates a hidden card, they may choose to hold priority and activate a second card immediately, or they may choose to pass priority to you.
4. Returning to the Defender: If the defender activates a hidden card and then passes priority to you, and you also pass priority, the chain resolves. Once that chain resolves, priority returns to the attacker. The defender can then activate a second hidden card only after the attacker passes priority back to them, provided the showdown has not concluded.

Important Considerations:

• Do Not Pass: If the defender passes priority to you, and you subsequently pass priority, the chain resolves. If no further items are added, and both players have now passed, the showdown ends immediately (Rule 347.3.a).
• Timing: As stated in RiftJudge FAQ #6529, both players must pass priority to move forward. If the defender activates one hidden card and passes priority to you, you must pass for that chain to resolve. Only after that resolution and your subsequent pass can the defender act again.

This interpretation follows the standard showdown priority rules: as long as the showdown is active, and the defender has not passed their opportunity to act, they can continue to use their available hidden resources.

Note: I could not fully verify this ruling against the retrieved rules.