They say the attackers reset passwords on the accounts. Any competent engineering team would have a complete list of those events in logs

You can't assume competence after such an hack. Before this has happened, you would have assumed that Twitter employees wouldn't fall for social engineering on this scale.

I wonder especially how they could have bypassed their 2FA.

Unless they specifically tell you something, you can't assume it to be the case.