If it's just about internal access, how is it any different from implementing access controls? Put another way, at Twitter's scale, any employee access to production data is intentional.
Correct, but with everything in plaintext one just needs to read a file stored somewhere in a database. With encryption, one needs to perform an active attack.
