How come Facebook is so secure but Twitter is not?

Speculation: some of Twitter is still written in Ruby (I know they are rewriting their Ruby into Java, but don't know whether they've completed that yet), and the attackers got in using one of the recent Ruby exploits.

Whereas Facebook don't use Ruby (afaik they use their own custom PHP implementation).

Your question is misguided. The real question is why are some technologies subject to particular exploits and others not ?

And the reason is that technologies are implemented differently.