It's not really a "security issue" in the way we think of them. This is just an -- optional -- security feature that isn't working, and as it turns out, not working on just one person's account. The OP shows that Twitter Security actually did investigate reasonably promptly, and replied that they couldn't repro the issue.

And I think that's not unreasonable. The security team is mainly about triaging security vulnerabilities. They likely aren't equipped to deal with an issue that appears to be restricted to a single account, that's related to an optional feature.

Now, Twitter's main-line support seems to be worse than useless, but I suppose that's to be expected, sadly.