It makes no difference what moxie said or seen. Facebook may have an offshore account set up for moxie, they may simply be showing alternative source, they may

It makes no difference what moxie said or seen. Facebook may have an offshore account set up for moxie, they may simply be showing alternative source, they may have a rigged build system that builds from the patched source, etc. Seeing the source is the first necessary step to establishing any sort of real trust in a compiled binary. You are also gravely mistaken in thinking that other people will take apart the binaries. It took several years for someone to try and verify a TrueCrypt build, which has a far more technical and privacy-minded following than the Facebook app. And even if some altruistic soul will do a binary audit of Messenger, it's all for naught as it's not a sustainable process. Every build needs to be verifiable and the source needs to be routinely peer reviewed for the binaries to be trustworthy. Doubly so in the Facebook's case given the very nature of their business.