I read the article and thought, "well, yes, the option that needed to be enabled on the account for the attack to work describes what the API did, what is the bug?"

I found the original notice from twitter [1] easier to understand (maybe change the URL of this post?) and it does not speak about a bug. Twitter did implement a change so that the attack cannot be done anymore though.

I did not understand the fix itself, it seems the API cannot be used for its intended use anymore?

[1] https://privacy.twitter.com/en/blog/2020/an-incident-impacti...