A Stack Exchange employee confirmed in chat that Twitter oneboxing was disabled due to creating a potential security risk:
We had to close some gaps when the hack thing happened last year... and ... if I understand correctly, the Twitter API made use of one of the gaps we closed... so... I think it may be permanent.
It's no coincidence that you saw this break almost right after Stack Exchange servers were compromised in May 2019. The blog post states that a number of other attack vectors were closed as a result:
Our team has taken, and continues to take, a number of steps as part of our response to this incident, including:
[...]
- Remediating the original issues that allowed the unauthorized access and escalation, as well as any other potential vectors that we have found during the investigation
As per Catija's message above, the part of chat that used the Twitter API to fetch tweets as they were oneboxed was identified as a potential additional security risk, and so it was disabled.
As tweets were loaded from the API when the message was posted and were cached indefinitely afterwards, prior oneboxes continue to display correctly, but newer ones will no longer work.
Additionally, it appears that the following oneboxes were also disabled as a result of the security issues:
- Blog Overflow
- GitHub Gist
- Identi.ca
- Twitpic
Originally a comment, but upgraded to an answer as it seemsseems final is final.
Update: A developer has given more insight as to the security reasons why this was disabled. Basically, the source code for chat was leaked, and it contained the API key to access Twitter in plain text. While the key was deactivated and recycled, there was no way to re-integrate the new key into the code in a secure, non-decipherable manner in case of a future leak, so it was left out.
