Their intentions will matter a lot. Are they just collecting accounts or was there intention to move trillion dollar markets/start riots or wars/etc.

Lots of people have the ability to do bad things.

Seems you believe they should therefore all go to prison,

also if they didn't actually do those particular things

Then we should regulate Twitter's security controls like we do banks? A breach like this at a bank would get them investigated and fined by multiple state and federal agencies.