Only 2.3% of Twitter users had any MFA method enabled from July to December 2020 (twitter.com)

That doesn't surprise me... MFA methods tend to be a real pain in the rear, so lots of people avoid them.

I mean I bet most accounts probably don’t care even if hijacked

Sounds legit, since only 3% of all twitter accounts are actually used.