It's not proven, but honestly, that doesn't matter. This is all about public perception. If it feels like Apple did something wrong, they might as well have, at least as far as their PR response ought to be concerned.
If there is no evidence, and they have stated that it wasn't them, anything else is malicious innuendo.
Google recently stated that the 5 million sets of Google account credentials were not stolen directly from them and only 20% of them were valid. Is this also 'unproven'?
Apple of all companies supposedly knows the value of appearances (see, for example, their purchase of Beats). I think maybe this was a "too much Kool-aid" kind of moment, where they just forgot that not everyone sees their services like they do.
