While the account does seem a bit odd — especially in our current state — it stills boils down to the fact someone discovered a bug and they seem to have receipts.
Linked tweet shows an email signature on reply from “Deven” of “Apple Product Security” and the senders original message. >> https://twitter.com/mgt7500/status/1090079031666438144?s=21