I believe they're Zigbee Home Automation, not ZLL. Either that or they're improperly reporting that they support ZHA instead of ZLL, which causes issues for 3rd party bridges like Philips Hue. https://developers.meethue.com/comment/2686#comment-2686
You're correct. It says in their FAQ that they're using ZigBee Light Link, AES-128 and have put time and effort into preventing them from being hacked. They also say that they work in a mesh and should be compatible with other products per the ZigBee Alliance.
says no API access in the first version but IKEA is working towards an open system.