ZKP for product of two primes

so the verifier learns square roots of numbers in the group which it could not compute on its own before.

With Fiat-Shamir transform, these roots will be of random numbers. And the learner could easily compute those by sampling random $x$ and computing $x^2$ (modulo $N$). This distribution is not distinguishable from $(sqrt{x},x)$ pairs that would be given in the protocol.

I'm guessing:

"HVZK" stands for "honest-verifier zero knowledge", right? Your objection is that a dishonest verifier can choose a random $x_i$, compute $rho_iequiv x_i^2mod N$, and then when they get $sigma_i$ from the prover, there is a $1/4$ chance that $gcd(sigma_i-x_i,N)$ is a non-trivial factor. But an honest verifier should generate random $rho_i$.

This should be secure, based on the following: Suppose $A$ is an algorithm that can factor $N$ given random $rho_i$ and $sigma_i$ such that $sigma_i^2equiv rho_imod N$. Then we can factor any $N$ with $A$ by picking a random $sigma_i$, computing $rho_iequivsigma_i^2mod N$, and sending $rho_i$ and $sigma_i$ to $A$.

It seems intuitively true that the Fiat-Shamir tansform should be able to turn HVZKs into NIZKs (probably with some extra conditions). An HVZK could fail because a dishonest verifier can send a "dangerous" challenge which reveals information, but a Fiat-Shamir forces the challenges to be random. As long as such dangerous challenges are sufficiently rare, then the Fiat-Shamir transform should produce a NIZK.