Earlier quoted context omitted.
I think the author meant that the exceptions were Oculus, WhatsApp and Instagram. This would make sense given that they are acquisitions and appear to have separate offices, deployments, datacenters, etc in some cases.
Data point: I read it the other way, that all employees could look at all of those things, and that the exceptions were un-named. I'd imagine the exceptions are some small black boxes that try to catch abuse/spam/etc in various ways & places, or are closed off to prevent a code leak from exploiting a loophole in said software. Defense in depth, and all...
For the most part, the exceptions are acquisitions (but those get integrated eventually, see above) or some third-party IP subject to obligations.