"I agree. The first thing I thought was that someone will build a script that creates a Twitter account then simply uses Twilio's API to create a valid phone number to receive verifications."

Unfortunately, this will not work.

Twilio numbers are not "mobile" numbers and cannot receive SMS from shortcodes.

So while your twilio number can send/receive SMS just fine, it can't receive SMS from a shortcode.

As of my recent conversations with multiple Twilio engineers at Signal 2018, there are no exceptions to this rule - once a number is owned by Twilio it ceases to be a "mobile" number and networks providing shortcodes cannot send SMS to it.

In my experience, all banks/twitters/facebooks/etc. use shortcodes to send their auths/2FA/etc.

So it won't work, I'm afraid. I have heard, however, that there are some smaller twilio competitors that provide true mobile numbers but I forget the name(s) of those providers and honestly, I would be worried that those numbers would get blacklisted or filtered in some other way.

There's a reason other carriers refuse to send shortcode SMS to "non mobile" numbers ...