> How about an official statement from Facebook itself over a year ago

That also doesn't count as proof; it carries barely more weight than the Facebook exec's statement.

However, you're quite right about the decompiling argument. And chances are that security researchers have done just that.