The important point here is that your app is open-source and you chose to distribute the keys with the source code, rather than require each person who builds it from source to get their own API keys.

I think Twitter's position - that you should not have done this - is completely reasonable.