It's more than the app (whose code and core protocol you've mentioned) - it's keeping OS up to do, firewalls, opsec, watching for suspicious activities: These are all things that facebook (the company) does that need to be taken care of on every pod/node.

If it's federated, it means thousands of accounts are likely going to live on each server - and many of those servers will be easy to hack. It is in that sense the facebook does a better job securing it (and they have shown that they can do opsec) -- not any theoretical "centralized vs distributed" argument.