Re: Victim shaming
Your concerns are valid and they are often taken into account during extradition hearings. In many cases, if country A does not think the event was a crime, they will refuse to extradite. If country B's punishment for the crime exceeds country A's, it is common that country A will only agree to extradite under some conditions including a limit on punishment. These considerations are often seen in such cases, and there have been cases where country B decided not to meet country A's requirements and country A refused to extradite and charged the suspect themselves.
As for your discussion on where Twitter is located, that is somewhat clear. The company is located in the United States. They may own other entities, but the entity which controls the servers which were broken into is the main company based in the United States. The crime that is mostly being discussed here is accessing those servers, meaning that the locations of the people impersonated is not at issue. The location of the people used during the attack is similarly unimportant. In this case, the U.K. and U.S. both have jurisdiction over this particular suspect, so the U.S. may request to have the suspect tried there. If they do, the U.K. will be free to refuse that request and they will consider points such as yours when they do. It is worth keeping in mind that, should the U.S. make a request, it is not only legal but very standard for cases such as these.
Biting the hand that feeds IT
