If I have additional root level folders in my phonegap project (same level as hooks, platforms, www, etc), will those folders and files end up in the final application file(s)? I've been keeping some additional project related files and documents in a separate folder but they do contain some sensitive data that I obviously don't want anyone with the application files to potentially access.
No, www is the root directory that will be copied to your package file.
When you build your app, whatever is in your www directory will get combined with what's in platforms/[current platform]/platform_www.
And of course any build hooks that you've added could potentially add files to www too.