Which is trivial to fake by going to your own profile and using your browser's inspector to swap out a few images and change a few text boxes.

I kind of think it's a toss-up if this is true. I can believe Trump would use a very weak password and not apply 2fa, but I'm very surprised that Twitter's additional guard-rails for important accounts didn't prevent this.