Say that my wallet is connected to a malicious miner. Of course this miner can DoS me and ignore all my transactions, but can they withhold it and release it to the network in the future? Or is the transaction only valid for the current block ID?
Transactions don't have any knowledge about which block they will end up in. A transaction is basically valid forever. Of course there are reasons why it might not be valid anymore when it gets broadcast but that is only noticed when nodes try to execute it, such as:
1) The sending account has too little Ether
2) The contract you try to interact with has been self-destroyed and no longer exists
3) The nonce has been used already for another transaction
So yes they can withhold it and release it when they want to.