Because you want your users to be able to access the service if Twilio is having downtime rather than your service being essentially down for them. Twilio killing their account was probably not an assumed use case. The biggest expected impact was new user SMS authentication which you could run after the downtime is over. Better some spam users than losing those potential users was their thought I'm guessing. I suspect password reset also failing open wasn't thought of as deeply because it's a rarer path but it got bundled together with the SMS auth code path.

edit: I'm sure we've all had really stupid requirements pushed on us by the business side for the sake of user experience or increasing metrics. Or written bad code at 3am during crunch time.

"The truth is, these are not very bright guys, and things got out of hand." - Deep Throat, during Watergate

Many businesses today still grapple with the decision to fail-open or fail-closed for things they build in-house.

>Why would anyone design a system that way

Because they knew that, being a save haven for violent white supremacists, it was likely one or more of their service providers would terminate service and wanted to continue to operate despite any termination.

This assumes it was by design, likely someone unfamiliar with the security implications thought they were improving the customer experience by not failing hard.