Nobody in infosec is surprised that Twitter had unpatched servers, lax access controls, an immature SDLC, poor backups, and all of the other security debt that you'll find in most large enterprises. BUT...