Claim 1 is 100% true if we're talking about end-to-end encryption where Dropbox doesn't have the key. That is more likely what the parent meant.