The system the NYTimes article outlines is still quite different from what the original leak suggested. According to the Times article, the requested data isn't placed into the locked mailbox until the FISA request is reviewed by somebody at the company. This is nowhere near the same level of access as what the PRISM leak suggested. So if what the Times article says is true, Zuckerberg and Page's statements weren't misleading at all. They really do "review each and every request."

The fact that they've built special systems for giving the government the data is not too surprising or scandalous. If I ran a site getting the same number of FISA requests that Google and Facebook presumably get, I'd probably also design a special system to make the process more convenient and secure. Short of openly challenging the NSA in court, this is probably the best response we could hope for. It gives the company control over what data is released and is much more secure than a back door which could be compromised.