The privacy setting on a given FB post is most likely a list of which "friend groups" within your account can see the post, and modifying that value in the database would change how the post appears. Whatever you choose is just a different parameter that gets stored on that post and can trivially be modified on FB's side in the future. FB could make every post you've ever made show up as public, and update your profile to be completely public as well. It's completely technically possible, though not too likely to happen.

Regarding the other point - the fact it took them 5 days to revert the privacy status on weeks' worth of posts of some ~14million users just points to them being thorough and _not_ doing it in a hacky manner. A hackish solution could have been done in an hour or two, most likely.