Claims aren't worthless, they'd be breaking the law if they lied. Apple has a pretty decent incentive to not break the law (PR mostly, but also fines), so I would bet they're telling the truth here.
If security researchers couldn't audit closed source software they would be pretty rubbish at their jobs. It's a lot easier to audit open source of course, but researchers do reverse engineer closed source stuff all the time.
Well you can always look at the network packets, most easily accomplished from jailbroken devices. There are many people who look at such matters. It's far from worthless.
Can't Apple push silent code updates to specific phones? That would mean they can access that data whenever they choose to. Even if they don't do it right now, they retain that ability.
