Internal controls at a company of the size of Twitter is no longer optional. You don't have to intend malice to be guilty of negligence.
Equifax never gave guarantees of security and data safety either, but it's understood that they should be responsible.
