It’s nearly always as simple as this. I got flamed on here for suggesting that Twitter just needs to follow NIST or similar standards to avoid the hack they had last year instead of hitting expert security researchers.