Depends on how you define the victim.

One could argue that the victims in this case are the people whose profiles had been hacked.

As for having full blown security getting in the way of getting stuff done, try replacing "Twitter" with "Equifax", a company that handles arguably more sensitive data and should have the "full blown security" you mentioned.

Did they suffer any tangible consequences?