Twitter only supported 2FA using a mobile number for several years, so they quite possibly have that.

People are not always good at infosec for convenience, and Twitter's design for this was incompetent even before Musk's acquisition.