They aren't being accused of a crime (or at least most of the controversy isn't about things that are normally considered crimes), so I'm not sure if innocent-until-proven should necessarily apply.
Innocent until proven guilty is as much logic as law/ethics. There is nothing Facebook can say or do to prove their honesty, but their dishonesty can be proven, eg, someone could leak data which could plausibly only have come from the sort of backdoor they say doesn't exist.
Of course, even if you can't prove anything, it might be prudent to hedge against the possibilities by assuming everything is actually public, but given the sort of things people post publicly (to four thousand of their closest friends and confidants) on Facebook, that might be a pretty low bar.
