As I understood it, twitter is following redirects to show the user the final destination in the card. The problem is the scammers recognise when twitter is generating the card and redirects twitter to a different domain than the what the actual user will be redirected to.

The problem is that twitter follows the redirects to show the final URL, presumably to support advertising companies that use third-party link tracking software like bit.ly, if they just showed the actual link they wouldn't have this problem.