The problem is that before these leaks, the Director of National Intelligence was asked point-blank in a congressional hearing whether or not the NSA was conducting surveillance on Americans, and he unequivocally said no. Given that history, I think it's prudent to approach the veracity of further denials with caution.

It's true that Facebook is not the US government, so perhaps we should be less hesitant about the claims they make. However, Facebook does have a history in this area that gives me some pause. Their former CSO was Max Kelly, who is ex-FBI, and would give talks about shit like the need for "uniting" military and commercial "cyber defense." So to the extent that we're dependent on Facebook's internal narrative to determine how they respond to the US government, my sense is that at Facebook, much of that narrative was set by someone who is largely sympathetic to government cooperation.

I think you're correct in pointing out that the NSA is ultimately to blame. However, I think we should acknowledge that while companies like Facebook obviously do not have malicious intent, they are still in the surveillance business. What they are building does have some inherent danger, and will continue to attract the interest of the US government, foreign governments, and attackers.