In the worst case it only allows Twitter to see whenever someone accessed the api.

But you're also considering that most monero users are anonymous, and use VPNs, or Tor.

So really it doesn't tie any particular transaction to a person.

It could tie information to the block the transactions was in potentially but without poisoned outputs, they couldn't guess the output result.

This is no different than zaps, or posting your Bitcoin/Cryptocurrency addresses publicly.