I'll note (again) that the NSA slides could indeed be talking about direct from the central servers of the company without actually having direct access to the central servers of the company.

This is also not a pedantic point. It's almost literally like adding a getter method to a class instead of giving direct access to a member variable. E.g, for range-checking.

  class GoogleCentralServers
  {
    vector<CompanyApprovedFISA> m_fisas;
    vector<PersonalData>        m_persons;

    // ...
    PersonalData PRISM_get(int fisa_id) const
    {
      if(fisa_id < 0 || fisa_id >= m_fisas.size())
        throw GFY::NSA{};
      else
        return m_persons[m_fisas[fisa_id].person_id];
    }
  };

In our 20¢ implementation of PRISM we can see that the data is still coming directly from the personal data store, but that the NSA does not actually have direct access to that data; it has to go through a company-provided intermediary that checks that the request is valid and only then proceeds to obtain the data and return it.

In fact I'm pretty convinced this is the most probable explanation of all the different testimony and evidence provided to this point. You could later add provisions to do real-time updating of the data in the lockbox, etc. etc., but that wouldn't change the core of the system.