Anyway, twitter has had app based 2FA since the end of 2017...
https://techcrunch.com/2017/12/20/twitter-adds-support-for-a...
A year ago, they added security key support:
https://9to5mac.com/2021/06/30/twitter-users-can-now-add-sec...
You don't need a phone to have security.
When I say I'm pretty sure that this machine wasn't compromised that is because I'm utterly paranoid when it comes to stuff like this. Possibly not paranoid enough - given the evidence just obtained...
(don't answer that, just something to think about)
These days, you can never be too paranoid. I religiously 2FA all my accounts the moment I create them.
That's a good one: on a server with an asymmetric encryption system (different decryption key than encryption key) the decryption key is not stored in any automated system, the back up is 'pull' from that one server inbound to this machine.
I guess it is theoretically possible that someone broke into the backup server but it too is locked down pretty good, to the point that if I want access I'll have to get into the car and go there in person. Call me paranoid :)