And in the DES s-box case, you'd have been right to trust them, because they fixed a vulnerability in DES 20 years before the theory behind it would become public. They couldn't disclose the reasoning behind the new s-boxes without disclosing differential cryptanalysis, because they generated the new s-boxes by first generating random candidates and then testing them for resilience against differential cryptanalysis.