I wonder is Twitter even using this any more? I report spam a lot and i's common to find 50+ identical tweets being pumped out at the rate of 10/minute, or tweets that include variation but link to the same piece of media or URL hundreds or even thousands of times. Given the quite fine-grained control in the filter stream API, it's very easy to get streams of spam, so I wonder what their excuse for letting it prolife…
At Twitter scale, arbitrary hard-coded rules are almost always useless; they make life more difficult for authentic posters while nefarious actors can work around them with varying degrees of triviality.
With hand written (not arbitrary) rules it's easier to understand the intent of the attacker and build a system that they can't work around because we're blocking them at their source of income. Sure they can figure out how to post messages but unless they can include their link/payload/etc it's not worth their time.
Machine learning defences are definitely a part of what we did, but they're slower to respond to attacks and generally easier to work around.