They also own the client so it'd be trivial to send the data back to Facebook after it's decrypted on the client. It'd be really stupid to do that, but it's Facebook.