Nope, I'd like to see that claim encoded in strict legalese, along with open source code, public pentest results, and a secure way to report found security (= data breach) issues.

But the strict legalese isn't going to happen because it would only take one data breach for the company to be destroyed by lawsuits. There's always a clause in there somewhere.