While your comment is technically true standing alone, you've also slightly misunderstood what the 5% figure is about.
It's not "users who use our website or 1st party apps", it's "monetizable daily active users", which may be similar to the group of users you described, but most importantly Twitter can choose not to show any ads (or not to charge money for ads shown) to bot accounts.
So even if Twitter only had 1 single non-bot user, as long as that's the only user they are "monetizing" they would be at 0% of mDAUs being bots.
Therefore, as jcranmer commented elsewhere in this thread, the 5% is actually their estimate of their own false negative rate of detecting bots (i.e. deciding which accounts can be monetised vs not).
It's not "users who use our website or 1st party apps", it's "monetizable daily active users", which may be similar to the group of users you described, but most importantly Twitter can choose not to show any ads (or not to charge money for ads shown) to bot accounts.
So even if Twitter only had 1 single non-bot user, as long as that's the only user they are "monetizing" they would be at 0% of mDAUs being bots.
Therefore, as jcranmer commented elsewhere in this thread, the 5% is actually their estimate of their own false negative rate of detecting bots (i.e. deciding which accounts can be monetised vs not).