Something that I haven't seen discussed - all Twitter employees are currently working remotely. Do we know if that has influenced the feasibility of the hack in any way?
If I had to guess, it could be that because of remote work, the employees had to use Twitter's VPN. Because they were using it, the attackers somehow managed to get access to it which may have been required for using the internal tool.
If there was no remote work, the employees would not have had to use a VPN, which means that the attackers may not have been able to use the tool from the outside.