It’s definitely not ideal that they wouldn’t change passwords for those things frequently but that’s definitely not that weird for even a big company I feel like. But I think It’s kinda unprofessional/petty for him to be informing them though a public twee like that lol.
And I’m not saying like it’s totally fine cause that is pretty poor security on jagexs part but that’s something I could see happening with the social media accounts of any large company. Still it’s not that big of a deal that he tweeted that either, just seems a little petty to me.