They shouldn't have to be legally obligated to make them have decent security as a simple business practicality. Private data can be something as simple as DMs

They shouldn't have to be legally obligated to make them have decent security as a simple business practicality. Private data can be something as simple as DMs between people, which if leaked can cause plenty of trouble (an example that comes to mind is streamers having to deal with a lot of drama from their fanbase because leaks revealed they were acquainted with a streamer of the opposite gender). On top of that with so many government officials and company CEOs on the platform it should be pretty obvious why access to the backend should be carefully controlled. There already was that incident a few years ago where someone got access to the backend via social engineering and tweeted out crypto scams from high profile accounts like Musk, Biden, Bezos, Apple etc.