> and as it turns out, not working on just one person's account.

It's actually three. Three accounts, on three different browsers (Chromium, Firefox, Safari), using three different operating systems (Ubuntu, Windows, macOS). I was able to replicate it exactly as I've described every single time. They claim that they haven't. I'm in no position to try it with a larger number of accounts.

And that's basically the worst thing to happen in any bug report scenario: unable to reproduce. Obviously we all want our support issues to get resolved in a positive manner, but sometimes it's not possible. And it's not like we're paying for Twitter, so they have no obligation to help us beyond what they think might make their actual paying customers unhappy. You may disagree with their math on this one, but it's their math to make.

So the feature is explicitly for security? Security feature.

It is security for the user, not for the server. It is still security.

I'm not saying it's the right way to do things, just that it's not unreasonable. Corporate infosec teams just usually aren't staffed to deal with this sort of issue. At best they can pass the user to regular support, or pass the issue on to whatever engineering team is responsible for third-party 2FA. And that's where the issue lies: if Twitter's regular support wasn't completely useless, we wouldn't have this problem here.