As an outsider, I would have thought that the Twitter security team would have a set of high-value users (with @jack being at the top of the list) who'd they keep very close tabs on in terms of any unusual activity.
Realistically Twitter is where announcements are made by world leaders and major corporations, control of these accounts could have repercussions, although in this case it just seems to have been a general hack...
What could prevent an attack is limiting the features available to high-value users. One could imagine, for example, limiting 3rd party API access. Depending on what actually happened here, that might have prevented this. But there is a downside of reduced functionality for the owners of the accounts in question. There's always tradeoffs.
In an enterprise setting where people work in an office I don’t see the point of allowing self-service password resets. It opens you to huge risk for very little upside compared to having to physically walk into the office (if you aren’t there already) and have HR/line manager/etc do it for you.
It's less like a 2nd factor and more like a poor man's password-protected private key authentication, but it's way better than just a password.
U2F is "great".
TOTP can be phished, whereas U2F is virtually impossible to phish.
That control should not be solely in Twitter's hands.
Those leaders and orgs need to take a strong look at authenticity via ActivityPub self-hosted on their own namespaces.
And Twitter is where the audience is.