My guess is that Coinbase does indeed own most of the Bitcoins in multi-sig addresses. I don't see why that couldn't be true. Multi-sig usage is very low.
Wrong: Kraken uses Multisig. Xapo uses Multisig. Bitgo uses multisig. Bitfinex uses multisig. OKCoin uses multisig. Huobi uses multisig...
Do you want to guess again?
It does look like Coinbase has in fact been lying to users and investors.