How do we really know that this is actual deletion and not a deleted="true" in their databases?
We don't know that. If you're feeling charitable you could believe they're being honest, but if you not then you just have to wonder. There is no way Facebook could prove they don't have a secret server with your data on it somewhere. Proving that would be impossible.
It’s the regulation. I work on EU GDPR tech stuff currently (this stuff is HOT at the moment and I have a feeling that even many large companies are quite late on the train!) in financial services sector and while some data needs to be kept for x years according to the law anyway, rest really needs to be deleted and at least my current client really doesn’t want to play with the financial risks involved with getting caught in a possible EU GDPR compliance audit.
They could be explicit about exactly what they do with the data - that way there is some PR risk to them if they get caught out "recycle binning" data.
We don't know that. If you're feeling charitable you could believe they're being honest, but if you not then you just have to wonder. There is no way Facebook could prove they don't have a secret server with your data on it somewhere. Proving that would be impossible.