It’s called constructive fraud and Twitter is guilty as fuck. You can’t use poor or no controls to validate your user base which is the only base/source of revenue and claim ignorance.
It's not constructive fraud. The user base is not the source of revenue. The actual ad buys are the source of revenue. And the ad buys are priced by the advertisers via an auction and then only paid based on whether or not the intended action was taken by the person viewing the ad.
So, let's say you and I are competing to place ads on some twitter page. I bid $1 for the opportunity, you bid $1.50. Twitter didn't set the price, you and I did. Now, you win the bid, so you get top priority for your ads. But you're only paying for ads where the user does something - clicks through to the product, downloads the app, buys something, etc. If the user doesn't perform the action then you don't pay. Now, you can certainly pay to have the number of followers increase but if you think there are a lot of potential bots who will follow you, you price that into your bid.
At every stage of the process, the advertiser has knowledge about what they're getting. they know how many people click through the ads. How many people engage their content. And they can use that information to set the advertising bids at the auction.
I think people believe that Twitter says "We have XXX users so you have to pay us $$ based on that number of users." If that was true then being wrong about the number of users might matter. But Twitter doesn't do that.
It's like a department store being wrong about the number of unique visitors that enter the store daily. The store might be off on the total numbers but the companies that have items on the shelf don't really care about how exact that number is. They care about how many items get sold. It doesn't matter if the store has 5, 10, 15% errors in the daily visitor tally so long as they hit their sales figures. A 3rd party might complain that the daily visitor tally is off but the company's revenue numbers and products sold numbers are the only thing that really matters and those already account for the true visitor numbers.
To use another example. I have a Facebook page that I never use. It shows up on the total numbers list of facebook pages. But since I never buy anything, click anything, do anything through my page, it won't affect any numbers that matter - engagement rates.
Additionally, it's not fraud unless Twitter insists that their numbers are accurate. From everything I've read, they always hedge that their bot numbers are estimates.