The company will soon require users to pay for a Twitter Blue subscription to get sign-in codes via SMS. Security experts are baffled.