Depends on how you define the victim.

One could argue that the victims in this case are the people whose profiles had been hacked.

As for having full blown security getting in the way of getting stuff done, try replacing "Twitter" with "Equifax", a company that handles arguably more sensitive data and should have the "full blown security" you mentioned.

Did they suffer any tangible consequences?

The stock when down for a couple of days, that should teach them. On a serious and besides note, it's such a clash between company and user-experience (i.e. every NA citizen) incentives that credit scores companies have a stock in the first place.

Prosecuting is mostly irrelevant. A lot of attacks come from countries outside the reach of US law enforcement.