We now know it wasn't a 0 day. It was socially engineered access to internal tools. That's still a tricky one to lockdown.
Working from home of course always leaves open the question if a person was willingly participating in a crime or was forced at gunpoint.
However, in this case, looks like Twitter's internal tools simply give too much access to people to control access to Twitter accounts. Probably no gunpoint required, just a single compromised employee. It remains to be seen how willingly they have participated.
It just makes me sad that I see people spending their energy on good comments, unaware they're not being read by most people.