Here's a screencap of Philip Kaplan's newsletter from 2017 where he claims a friend at Instagram helped him get @DistroKid, which was registered but inactive:
That's not necessarily evidence of rogue employees being able to steal accounts for their friends. That may just mean that they had a friend at Instagram that helped them trigger the official process to delete an inactive account and give the name to someone who plans to use it.
In practice, it's the same thing: you have no way to know that this is not what happened to @danny, the consequences are the same.
It's unlikely that this is what happened to @danny, unless their account was inactive.
Similarly, I "took over" https://github.com/tasuki by simply messaging the customer support. They said it wasn't being used and I could have it.
The difference is that this is a documented GitHub policy [0]. I’ve done the same for a handle that didn’t have any activity in its entire history. AFAIK neither Instagram nor Twitter have similar policies (though I somewhat wish they did).