All true but the really bogus part IMO is that by default it would unfurl to the actual, bad URL but if you remove the &=1 param it unfurls to the good domain. Why is that?
I'm not really sure, ask Twitter since the amp=1 thing is just generated in their mobile website and application. This is definitely a guess, but maybe some websites implement AMP by checking the referrer and redirecting to it, and Twitter interprets that as "let's backtrack to the last page, that's the canonical version" and uses that?