The issue here is that only twitter knows who they count as a mDAU. So there could be a lot of bots that are simply not included in their counts.

Well, it depends on what is in the firehose. What twitter really knows that you can't just see, is how (with what client) users are logging in and whether their ad tracker URLs are being triggered (i.e. the user really did result in an ad impression). If Musk can determine that directly or indirectly from the firehose then he could say "here's how I calculated it and it's 9%" or something, I guess.

Using entirely made up nunbers, I think the situation is something like:

* Firehose shows 800m accounts were active yesterday

* Using data from the firehose (user agents, IP addresses, behaviour analysis, etc.) you can flag 500m of those accounts as fake, spam, bots, etc., leaving 300m

* Twitter then uses their experience, intuition, business judgement, etc., to apply an additional adjustment to those numbers, reduces them by 25%, and announces a mDAU of 225m

* Musk calls foul, and says they should have used a bigger discount, because a lot of that 225m are still fake or spam accounts

* Twitter says no, they're pretty sure it's like 11m of that 225m at most

In this hypothetical, the firehose data isn't helpful, because it's just one of the inputs, and not the one that's in dispute. Musk isn't arguing about whether there were 800m (or whatever) total active accounts, or 300m seemingly real accounts, but over whether 25% was a good guess for how many fake accounts were hidden in that seemingly real accounts.

The big issue with this is as far as I am aware the fire hose will only give information about active users, which likely leaves a big number of passive users out of the calculations

Ah yes, I should have clarified I was assuming that the firehose even has the needed data; I don't think it's clear that it does.