they've been killing anything that acts remotely like a client. one of my apps was killed for letting users post scores directly. so they certainly do kill 3rd party supply of content if it looks anything like a client. it's sort of like Google Groups where I can get banned just by opening a lot of tabs at once to read later. their enforcement is pretty mindless and probably automated.
posting content is not the same as supplying content. cards are just meta tags that are used when twitter crawls the link that is posted.