I’m surprised becoming verified doesn’t require something akin to Google’s enhanced protection program (e.g. requiring 2FA not including SMS, delaying password reset notifications, etc). I don’t think the average Twitter user needs to be subjected to that, but verified accounts being taken over have a bigger blast radius than just the individual losing their account; the scammers get notoriety and legitimacy with that blue check.