While the account does seem a bit odd — especially in our current state — it stills boils down to the fact someone discovered a bug and they seem to have receipts.
Ya that poorly obscured email in the message is strongest evidence to suggest this is a real twitter account & story - I believe it’s legitimate. Which makes this story really interesting, that the kid found it, the parent knew how to bug report, the parent went to a twitter account they only recently started using to try to get the word out, and nothing happened. Goes to show process needs improvement and that bug reports truly can come from anywhere.
Linked tweet shows an email signature on reply from “Deven” of “Apple Product Security” and the senders original message. >> https://twitter.com/mgt7500/status/1090079031666438144?s=21