You are incorrect - there is a legal concept known as strict liability that defines an instance where one party is completely liable for damages to a party, regardless of the negligence of any other party. I am sure Twitter didn't run afoul of that concept here, but the question is, "should they?" Presumably, a skilled person with only a few years' experience was able to find a flaw in their system so severe, that multiple political and business leaders' accounts were manipulated. It's a dangerous embarrassment.