I mean they physically can't implement the cipher in a way that allows for a backdoor, it wouldn't work(unless they are simply lying about how they encrypt the data I guess, but some quick reverse engineering of their app should figure out pretty easily if they aren't actually using AES-256).

That's why it's a good idea to use open source security tools though. You can read the source code to make sure there's no funny business going on.