They don’t have to be malicious if they are incompetent.

They could say they don’t use logs and not realize that their tech stack is actually keeping some sort of metadata or maybe using swap or something. Probably not as likely as the other scenarios, but I wouldn’t count it out completely.