this is less "this 17-year-old is such a genius that he can hack Twitter" and more "Twitter's sensitive account security practices are so garbage that a 17-year-old can hack Twitter"
So, we are to believe this guy somehow got internal employees to give up their 2-factor authentication and allow him access to their root app with full knowledge of how to use it......ok. He must be a silver-tongued devil.