Agreed. It’s a bit of column A and column B. Twilio shouldn’t have disclosed the services that Parler were using. Parler should not have allowed unverified users to log in ESPECIALLY if they’re dealing with PII. (Verified Parlers submitted photos of their licenses.)
Either way, this feels like something that will end in a lawsuit.
I wouldn't blame Twilio. It's entirely Parler's fault they allowed an unvalidated account to successfully register and log in.
Of course, it's also entirely the intruder's fault they exploited the wide open security hole.