Defaults matter. Twitter is public by default and the whole ecosystem is based on this assumption, the private setting is just an afterthought. Sure, you can tweet privately, but then you lose most of the features, and I wouldn't rely on security of that.