Not just that. I'm pretty sure i read somewhere that they employ a very decentralized and redundant architecture, where almost nobody is in a position to compromise the entire setup. They had to evolve this way after it became clear that Swedish authorities were after them. From what I understand, even their own admins often don't know where their servers are anymore.

This resistance to physical attacks is why countries eventually started blocking it at the consumer end, through ISP-enforced bans.

It's a shame they can't talk more openly about it, I'm sure they could teach some valuable lessons in reliability.