2FA would be ideal, but GeoIP restriction requires no action on the part of the end-user. If implemented properly, Twitter should have been alerted that something was fishy when an IP from the Netherlands sent a successful login password and prevented it, then e-mailed the user to ask if the login attempt was legitimate. It saved my butt once when Gmail prevented an IP originating in India from logging into my account and alerted me.

I realize the circumstances of the world have somewhat changed over the past several months, but its not implausible that the US President might travel.

i would have assumed a security researcher was smart enough to use a vpn located in the US

If Twitter banned Trump, a Trump-branded Twitter clone would pop up overnight with a built-in audience of 87M followers.