If they say they don't, and they do, then that's fraud, and they could be held liable for any damages that result. And, if word got out that they were defrauding customers, that would result in serious reputational damage to Apple (who uses their security practices as an industry differentiator) and possibly a significant customer shift away from them. They don't want that.
Absent the source code, it's incredibly difficult to disprove when the only proof you have is good vibes.
Apple has the number 1 marketing team in the world. They got away with PRISM and terrible security.
They are immune to reputation damage. Teens and moms don't care.
The government would never prosecute a company for fraud where that fraud consists of cooperating with the government after promising to a suspected criminal that they wouldn't.