Yes but not so much for this in particular. If I want to make a bunch of fake Twitter followers I would just generate new accounts and generate some fake tweets. It would take a lot more work to hack someone's account (who then might also notice it's hacked and try to take it back).

App permissions can still be a problem, but usually that is usually centered more around identity theft.

I doubt it scales. Probably easier to just sign up for additional accounts

Unlike credit cards they're not worth much so less incentive to hijack the real deal

One of my Twitter accounts that I was using only as an OAuth provider started tweeting spam. So yes, this does happen.