This sounds like an incredible fuckup by Twilio. If it's true that their authentication verification was the entrypoint, they could be liable for leaking an enormous amount of personal information.
It's highly unlikely Twilio's API responds with something like {"authenticated": true} when you haven't paid your bill or they suspend you.
It'd be as if a bank's security guard quit and walked off the job the day of a bank heist. He has the right to quit, but not a right to coordinate with the robber and leave his post for the purpose of assisting in illegal activity.
Whatever the case, this is going to be 'fun' to watch.
Does anyone have any suggestions?