It doesn't have to be extremely easy, and it isn't extremely easy at every company. Twitter's security was bad, worse than it should have been for their size/ data footprint.
I do agree that data collection is at the core of the problem, but Twitter really should have done a better job.