You can see it here (https://twitter.com/paraga/status/1526237578843672576).
Noteworthy highlights:
* Twitter estimates its <5% number from human analysis of multi-thousand user random samplings of mDAU
* Twitter allows that number to remain so high to avoid introducing friction like captcha into real users' experiences
* Twitter uses all sorts of internal private data in its analysis
* Parag says you cannot get a reliable indication of bot/not bot without this internal private data
Having just finished building a Twitter analysis tool, I agree with Parag that the Twitter API doesn't provide sufficient clarity to make decisions about spam. This article's analysis doesn't hold up - just because you can name several features you're going to use to generate a spam confidence score about an account does not mean that spam confidence score will have any precision.