But they can be changed via filters. I do that all the time to manage when certain request are being made (and making sure it's in a cron job and not a user-request).

WP Engine does run their own plugin in the instances they host, though I assume it's not obligatory. Still, every site I ever had to look at that was on WPE had it installed and enabled.

WP does come with its own CA certs, but that file could be appended (or replaced, again via filter) as well. Since they're comfortable changing things like the revision settings, I doubt this would be something they wouldn't do.

I'm not saying Matt is reasonable, but "it's not an easy thing to do" isn't true.