A Stack Exchange employee confirmed in chat that Twitter oneboxing was disabled due to creating a potential security risk:
We had to close some gaps when the hack thing happened last year... and ... if I understand correctly, the Twitter API made use of one of the gaps we closed... so... I think it may be permanent.
It's no coincidence that you saw this break almost right after Stack Exchange servers were compromised in May 2019. The blog post states that a number of other attack vectors were closed as a result:
Our team has taken, and continues to take, a number of steps as part of our response to this incident, including:
[...]
- Remediating the original issues that allowed the unauthorized access and escalation, as well as any other potential vectors that we have found during the investigation
As per Catija's message above, the part of chat that used the Twitter API to fetch tweets as they were oneboxed was identified as a potential additional security risk, and so it was disabled.
As tweets were loaded from the API when the message was posted and were cached indefinitely afterwards, prior oneboxes continue to display correctly, but newer ones will no longer work.
Additionally, it appears that the following oneboxes were also disabled as a result of the security issues:
- Amazon
- Blog Overflow
- GitHub Gist
- Identi.ca
- Twitpic
Originally a comment, but upgraded to an answer as it seems final.