It doesn't require ALL repositories, just those that contribute to the mobile app. I don't know about Facebook, but where I work there are hundreds of employees who have access to the source code of our mobile app and a few tens of employees who know the deployment process well enough that they would know if other code were being added as part of the deploy process.

Facebook apparently uses a single monolithic mercurial repository for everything so it would really be the repository.