The company lied about their encryption.
Both of these statements can be true, it's just a question of trade offs.