I was rejected with no explanation from a Twitter API key, despite it being for a real account that must appear very normal in every respect.

I think it's kind of funny that they are so draconian with hobbyists and people making toys, but that any motivated bad actor can probably access most of the same endpoints and services by virtue of the fact that they have to be accessible for people to use Twitter.