If my phone is compromised physically or with malware, this does nothing to protect my twitter account. Both proverbial eggs are in the same phone.
Of course there are still problems with two factor authentication, but it's better than the alternative.
If you lose your phone with two factor auth the provider should give you several temporary keys that you can use, or a way to contact their support line and confirm your identity.
> " or a way to contact their support line and confirm your identity"
That is one of the nice things about SMS 2-factor auth, the backup authentication method (lost phone) is on the wireless company instead of you. I suppose twitter can handle the extra responsibility though. They have ways of verifying accounts, so now it is just a question of scaling that for support.
This is one of the terrible things about SMS 2-factor auth! In exchange for having them be able to replace your phone (so your 2FA works again) you're giving them the ability to spoof you at any given time. From a company's perspective it might be better (don't have to deal with "I lost my ...") but it's a terrible trade off for users.
You should probably take a look at Twitters official blog post which has a bit more explanation[1]. I hear what you're saying about the "Well what if i lose my private keys" because we had the same issue with CACs. Every private key was escrowed somewhere, but you have to remember that this system is optional, not mandatory. This is security measure is designed to help prevent future AP incidents[2].
As far as phone compromise, that's a valid concern. Any large company should policy in place to regulate devices for validating logins (which don't happen that often). As far as individual users, we'll have to see. Since Android is the dominant mobile platform, I'm guessing that malware will be more prevalent on those devices.
[1] - https://blog.twitter.com/2013/improvements-to-login-verifica...
[2] - http://www.huffingtonpost.com/2013/04/23/ap-twitter-hacked_n...