If Dropbox say there is no issue and there was no (serious) hack then it is far more credible having outside auditors substantiating the claim. I'd be more troubled if they didn't call in outside experts since Dropbox's existing people and processes are what allowed whatever attack it was to happen in the first place.