It's not like there will be any repercussions if a few twitter accs get their dms stolen. Most people won't care (they don't even with stolen credentials from hacked dbs), can there be legal ramifications? Maybe, but that probably costs less than shutting down Twitter. Responsibility seems to be the last thing any of these companies think about