This seems to be working as designed, a website is loading cross origin material and not setting up the proper systems in advance. Twitter shouldn't get a pass on doing something unusual and suspicious just because.

Serve the images from the same domain.

I know Twitter probably fired the people who knew this entirely predictable outcome was likely, but like, they should have seen this coming.